GHSA-2v3v-3whp-953h — starcitizentools/citizen-skin allows stored XSS in user registration date message

starcitizentools/citizen-skin allows stored XSS in user registration date message

The advisory, in context

Summary

Various date messages returned by Language::userDate are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The result of $this->lang->userDate( $timestamp, $this->user ) returns unescaped values, but is inserted as raw HTML by Citizen: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60

PoC

Go to any page using citizen with the uselang parameter set to x-xss and while being logged in Depending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's november:

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

starcitizentools/citizen-skin Packagist

Ecosystem versions

From 3.3.0 before 3.3.1

Fixed in 3.3.1

1 explicitly affected versions

v3.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.3.0"
        },
        {
          "fixed": "3.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v3.3.0"
  ]
}

Set up in your agent.

Investigate in your agent.