Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue involving both server-side and client-side components of Semantic MediaWiki. The root cause is the use of a non-reserved HTML data attribute, data-subtab, to store user-controllable content that is later rendered as HTML.
The vulnerability is introduced in the HtmlTabs::buildHTML function in src/Utils/HtmlTabs.php. This PHP function generates the HTML for tabs and stores tab data in the data-subtab attribute. Because this attribute is not reserved by the MediaWiki parser, an attacker with edit rights can inject malicious HTML and JavaScript into it using wikitext.
The payload is triggered on the client side by JavaScript in res/smw/ext.smw.js. An anonymous function that executes on page load finds all elements with the smw-subtab class, reads the value from the data-subtab attribute, and uses innerHTML to insert it into the DOM. This unsanitized insertion executes the stored malicious script in the context of the victim's browser.
The fix, identified in commit 2205556463de49a90a7305babcc40a03e879855d, was to rename the attribute from data-subtab to data-mw-subtab. Attributes prefixed with data-mw- are reserved by MediaWiki and are stripped from user-provided wikitext, thus preventing the injection of malicious content.
HtmlTabs::buildHTMLsrc/Utils/HtmlTabs.php
(anonymous)res/smw/ext.smw.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/semantic-media-wiki | composer | >= 3.1.0, < 7.0.0 | 7.0.0 |