Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| starcitizentools/tabber-neue | composer | >= 3.0.0, < 3.1.1 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability was a classic Stored XSS issue in the TabberNeue MediaWiki extension. The root cause was the improper handling of user-supplied attributes in the <tabber> and <tabbertransclude> wikitext tags.
The core of the issue lay in the render methods of both the Tabber and TabberTransclude classes. These methods took attributes from the user, processed them using Sanitizer::validateTagAttributes, but this function did not escape the attribute values. The resulting string of attributes was then passed to a Mustache template (Tabber.mustache) and rendered using {{{html-attributes}}}, which is an unescaped rendering directive. This allowed an attacker to craft an attribute value that closes the existing attribute and injects new ones, such as event handlers (onmouseenter) or even new tags (<script>), leading to arbitrary JavaScript execution in the user's browser.
The fix was comprehensive. A major refactoring (62ce0fcdf32bd3cfa77f92ff6b940459a14315fa) completely rewrote the parsing and rendering logic, introducing new components to better handle data. The direct fix for the XSS (4cdf217ef96da74a1503d1dd0bb0ed898fc2a612) was applied to the new template (Tabs.mustache), changing the attribute value rendering from {{{value}}} (unescaped) to {{value}} (HTML-escaped). This ensures that any special characters in attribute values are safely encoded and cannot be used to break out of the attribute and inject malicious code.
The identified vulnerable functions, parserHook and render for both classes, represent the complete chain from user input to vulnerable output in the pre-patch code.
