- Notifications
You must be signed in to change notification settings - Fork7
Stored XSS through attributes provided to the 3d parser tag/function
Package
Affected versions
Patched versions
Description
Summary
The<3d> parser tag and the{{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.
Details
In the code of the<3d> tag, the$args provided to the tag are stored in theparams array:
Line 78 in78496c9
| $params =array_merge($wg3DAlloy,$args); |
Then, the
$par array is populated with these values:Lines 91 to 96 in78496c9
| $par = []; | |
| foreach ($paramsas$key =>$value) { | |
| if ($value !=='') { | |
| $par[$key] =$value; | |
| } | |
| } |
The arguments are then used as attributes for the HTML element that is being output:
Lines 106 to 108 in78496c9
| $elem = Html::element('canvas',$par,$input); | |
| return [$elem,'noParse'=>true,'isHTML'=>'true' ]; |
A similar thing is done for the{{#3d}} parser function:
Lines 124 to 136 in78496c9
| $i=0; | |
| foreach ($wg3DAlloyas$param=>$value) { | |
| if (isset($args[$i])) { | |
| $args[$i] =$param."=".$args[$i]; | |
| }else { | |
| $args[$i] =$param."=".$value; | |
| } | |
| $i++; | |
| } | |
| $params = []; | |
| parse_str(implode("&",$args),$params); | |
| $params =array_merge($wg3DAlloy,$params); |
Lines 140 to 145 in78496c9
| $par = []; | |
| foreach ($paramsas$key =>$value) { | |
| if ($value !=='') { | |
| $par[$key] =$value; | |
| } | |
| } |
Line 155 in78496c9
| $elem = Html::element('canvas',$par,$params["file"]); |
PoC
- Create a wiki page with the following contents:
<3donmouseenter=alert(1)>Test</3d>{{#3d:Model.json|width|height|color|opacity|zoom|pan|norotate|scale|z|style|class|onmouseenter=alert(2)}}
- Hover over either of the 3D viewers
Impact
Arbitrary JS can be executed by any user, which can lead to consequences like privilege escalation, DOS or infoleaks.
Severity
CVSS v3 base metrics
CVE ID
Weaknesses
WeaknessCWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Learn more on MITRE.Credits
SomeMWDevReporter