Change Details

The Title Icon extension is vulnerable to reflected XSS by abusing the unicode icon parser function. ## Reproduction steps: - Enable the [[ https://www.mediawiki.org/wiki/Extension:Title_Icon | Title Icon ]] extension - Insert the following code into a page: `{{#titleicon_unicode:<script>alert("XSS :(")</script>}}` (Special:ExpandTemplates does not work since it doesn't show the title icon) - Visit the page The XSS payload will very likely also be executed in search results, however I wasn't able to test this since searching did not work on my test MW instance. ## Cause: The supplied unicode for the icon is wrapped in an HtmlArmor without any prior sanitization or validation: https://github.com/wikimedia/mediawiki-extensions-TitleIcon/blob/bd722b67b55b87012b66226ed3542ccafe7a5173/src/IconManager.php#L407 ## Further information: * Tested on MediaWiki 1.43.0 (d7861af) * PHP: 8.3.14 (fpm-fcgi) * Extension version: 6.2.0 (bd722b6) * Browser: Firefox 138.0.3 (64-bit) on Fedora Linux 42

The Title Icon extension is vulnerable to XSS by abusing the unicode icon parser function. ## Reproduction steps: - Enable the [[ https://www.mediawiki.org/wiki/Extension:Title_Icon | Title Icon ]] extension - Insert the following code into a page: `{{#titleicon_unicode:<script>alert("XSS :(")</script>}}` (Special:ExpandTemplates does not work since it doesn't show the title icon) - Visit the page The XSS payload will very likely also be executed in search results, however I wasn't able to test this since searching did not work on my test MW instance. ## Cause: The supplied unicode for the icon is wrapped in an HtmlArmor without any prior sanitization or validation: https://github.com/wikimedia/mediawiki-extensions-TitleIcon/blob/bd722b67b55b87012b66226ed3542ccafe7a5173/src/IconManager.php#L407 ## Further information: * Tested on MediaWiki 1.43.0 (d7861af) * PHP: 8.3.14 (fpm-fcgi) * Extension version: 6.2.0 (bd722b6) * Browser: Firefox 138.0.3 (64-bit) on Fedora Linux 42

The Title Icon extension is vulnerable to reflected XSS by abusing the unicode icon parser function. ## Reproduction steps: - Enable the [[ https://www.mediawiki.org/wiki/Extension:Title_Icon | Title Icon ]] extension - Insert the following code into a page: `{{#titleicon_unicode:<script>alert("XSS :(")</script>}}` (Special:ExpandTemplates does not work since it doesn't show the title icon) - Visit the page The XSS payload will very likely also be executed in search results, however I wasn't able to test this since searching did not work on my test MW instance. ## Cause: The supplied unicode for the icon is wrapped in an HtmlArmor without any prior sanitization or validation: https://github.com/wikimedia/mediawiki-extensions-TitleIcon/blob/bd722b67b55b87012b66226ed3542ccafe7a5173/src/IconManager.php#L407 ## Further information: * Tested on MediaWiki 1.43.0 (d7861af) * PHP: 8.3.14 (fpm-fcgi) * Extension version: 6.2.0 (bd722b6) * Browser: Firefox 138.0.3 (64-bit) on Fedora Linux 42