Citizen MediaWiki Skin Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Citizen skin for MediaWiki, affecting versions 1.9.4 prior to 3.4.0. The issue arises because page descriptions are inserted into raw HTML without proper sanitization when using the old search bar. This allows users with page editing privileges to inject XSS payloads that will be executed in the DOM of other users searching for specific pages.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, disable the command palette and use the action API as the search gateway. Then, create a page with an XSS payload in the description, and search for that page using the old search bar.

Remediation

Users are advised to update to Citizen version 3.4.0 or later, where this vulnerability has been patched.