Wikimedia Foundation MediaWiki and Parsoid Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Wikimedia Foundation's MediaWiki and Parsoid. This issue arises from improper input sanitization in the 'Sanitizer.php' file, allowing malicious scripts to be embedded and potentially executed. The vulnerability affects several MediaWiki versions prior to 1.39.14, as well as 1.43.4 and 1.44.1. In Parsoid, the vulnerability impacts versions prior to 0.16.6, 0.20.4, and 0.21.1.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

The vulnerability can be reproduced by using the MediaWiki 'tag' template with a 'data-' attribute containing JavaScript, such as an 'onclick' event. This will bypass the sanitization process and execute the JavaScript alert.

Remediation

Users can update to MediaWiki versions 1.39.14, 1.43.4, or 1.44.1. For Parsoid, updating to versions 0.16.6, 0.20.4, or 0.21.1 is recommended.