In the Wikistories extension, multiple system messages are inserted as raw HTML, allowing for stored XSS.
wikistories-story-selecttext
Reproduction
- Install Wikistories as described in https://www.mediawiki.org/wiki/Extension:Wikistories#Install and https://www.mediawiki.org/wiki/Extension:Wikistories#Running_locally
- Edit MediaWiki:Wikistories-story-selecttext to <img src="" onerror="alert('wikistories-story-selecttext')">
- Go to /wiki/Special:StoryBuilder/Main_Page
- Select any image
- Click the blue ">" button
Cause
The system message is retrieved using the text output mode and then inserted as raw HTML using v-html:
https://gerrit.wikimedia.org/g/mediawiki/extensions/Wikistories/+/5907351fd2a971ab9839391bf93a3caf3766c5e5/resources/ext.wikistories.builder/components/StoryTextbox.vue#32
wikistories-story-edittext-duplicate
Reproduction
- Install Wikistories as described in https://www.mediawiki.org/wiki/Extension:Wikistories#Install and https://www.mediawiki.org/wiki/Extension:Wikistories#Running_locally
- Edit MediaWiki:Wikistories-story-edittext-duplicate to <img src="" onerror="alert('wikistories-story-edittext-duplicate')">
- Go to /wiki/Special:StoryBuilder/Main_Page
- Select any image
- Click the blue ">" button
- Click "Select story text from Wikipedia"
- Select any text on the main page, for example "Community portal – The central hub for editors, with resources, links, tasks, and announcements."
- Click "Add to story"
- Click the "+" button at the bottom right corner of the image
- Select any image
- Click the blue ">" button
- Click "Select story text from Wikipedia"
- Select the same text you selected in step 7
- Click "Add to story"
Cause
The message is retrieved through mw.msg(), implicitly using the text output mode:
https://github.com/wikimedia/mediawiki-extensions-Wikistories/blob/5907351fd2a971ab9839391bf93a3caf3766c5e5/resources/ext.wikistories.builder/store/story.js#L186
The message is then inserted as raw HTML using v-html:
https://github.com/wikimedia/mediawiki-extensions-Wikistories/blob/5907351fd2a971ab9839391bf93a3caf3766c5e5/resources/ext.wikistories.builder/components/StoryTextbox.vue#L22
wikistories-story-edittext-outdated
Reproduction
This should also be reproducible without editing the JS, but for convenience, I've used the hack in step 2 to get the warning to show up.
- Install Wikistories as described in https://www.mediawiki.org/wiki/Extension:Wikistories#Install and https://www.mediawiki.org/wiki/Extension:Wikistories#Running_locally
- Replace if ( frame.outdatedText ) { with if ( true ) { in line 202 of story.js
- Edit MediaWiki:Wikistories-story-edittext-outdated to <img src="" onerror="alert('wikistories-story-edittext-outdated')">
- Go to /wiki/Special:StoryBuilder/Main_Page
- Select any image
- Click the blue ">" button
- Click "Select story text from Wikipedia"
- Select any text on the main page, for example "Community portal – The central hub for editors, with resources, links, tasks, and announcements."
- Click "Add to story"
Cause
The message is retrieved through mw.msg(), implicitly using the text output mode:
https://github.com/wikimedia/mediawiki-extensions-Wikistories/blob/5907351fd2a971ab9839391bf93a3caf3766c5e5/resources/ext.wikistories.builder/store/story.js#L204
The message is then inserted as raw HTML using v-html:
https://github.com/wikimedia/mediawiki-extensions-Wikistories/blob/5907351fd2a971ab9839391bf93a3caf3766c5e5/resources/ext.wikistories.builder/components/StoryTextbox.vue#L22