-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the EmbedVideo MediaWiki extension. The root cause is the use of the data-iframeconfig HTML attribute, which could be manipulated by users through wikitext. An attacker could embed a malicious JSON payload in this attribute, specifying JavaScript event handlers like onload.
The vulnerability is triggered in a two-step process:
Storage (Server-Side): The PHP functions EmbedHtmlFormatter::toHtml and EmbedVideo::parseEVL were responsible for generating the HTML for the embedded video player. They would create elements containing the data-iframeconfig attribute, allowing the attacker's payload to be stored on the wiki page.
Execution (Client-Side): When a user interacts with the embedded video element (e.g., by clicking a link), a JavaScript event handler (an anonymous function in ext.embedVideo.videolink.js) reads the malicious payload from the data-iframeconfig attribute. This payload is then passed to the makeIframe function in iframe.js. The makeIframe function dynamically creates an <iframe> and sets its attributes directly from the provided payload, causing the malicious JavaScript (e.g., the onload handler) to be executed in the context of the user's browser.
The patch addresses the vulnerability by renaming data-iframeconfig to data-mw-iframeconfig. Attributes prefixed with data-mw- are reserved for MediaWiki's internal use and are sanitized, preventing users from setting them via wikitext. This breaks the chain of attack by preventing the initial storage of the malicious payload.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| starcitizenwiki/embedvideo | composer | <= 4.0.0 |
Ongoing coverage of React2Shell