Greetings, I found an XSS on one of the Wikipedia server endpoints.
the attacker could run javascript on the victim's account right after the authentication process.
POC Steps:
1 - Open the url http://wikipedia.ramselehof.de/wawewewi.php?project=
2 - send a javascript payload after the equals sign, and then the alert will fire
("></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>)
Hi @Schanz111, thanks a lot for taking the time to report this!
I'm subscribing @Flominator who seems to run http://wikipedia.ramselehof.de/ but I'm not sure how active Flominator is these days.
Just to be clear - this isn't hosted on Wikimedia production infrastructure ("Wikipedia server").
Doesn't it belong to your domain? could at least see if it is possible to fix the vulnerability
Hi, we (as in Wikimedia Foundation or affiliates) do not own the domain ramselehof.de. The domain is owned by @Flominator who is subscribed to this task.
Is there an easy way to fix this? I think I had a snipped somewhere, but I don't find it at the moment.
https://www.mediawiki.org/wiki/Security_for_developers#Cross-site_scripting_(XSS) might provide some hints
Is this the actual code base: https://github.com/FlominatorTM/wikipedia_wbw ?
If so, it looks like there are at least a few places where the $project variable is vulnerable to XSS:
At the very least, you'd likely want to sanitize those variables before they are sent to the browser by passing them to htmlspecialchars or similar, likely with the ENT_QUOTES flag enabled.
I'd also note that any other variables which are eventually sent to the browser that are derived from user data (e.g. from _GET, _POST, _REQUEST, _COOKIE, etc.) should be sanitized in a similar fashion.
Thanks for the explanation. I think it's fixed now:
https://github.com/FlominatorTM/wikipedia_wbw/commit/105ad5a7dd64db0e7a063b34be2fd70352b6a6d0
Hello gentlemen, I am very happy that you have patched the vulnerability, I would like to know if it would be possible to rename it to some Wikipedia cybersecurity Hall of Fame
As previously mentioned, since the affected code and website have nothing to do with Wikipedia or the Wikimedia Foundation, these vulnerabilities would not be eligible for the Wikimedia security hall of fame. I would suggest reaching out to the github code owner (@Flominator, FlominatorTM) and inquire as to whether they could credit you within an upcoming security release of the unaffiliated wikipedia_wbw application.