Vulnerability-Lookup

GHSA-RQ6G-6G94-JFR4

Vulnerability from github – Published: 2025-07-03 20:29 – Updated: 2025-07-03 21:51

Summary

starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions

Details

Summary

Page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar.

Details

The descriptions, which are unsanitized, are inserted as raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d4dfc3697a82948b3b9c4d44e9a273c79bc86b87/resources/skins.citizen.search/templates/TypeaheadListItem.mustache#L18

PoC

All of the reproduction methods require the command palette to be disabled via $wgCitizenEnableCommandPalette = false;. Additionally, the action API must be used as the Search Gateway via $wgCitizenSearchGateway = 'mwActionApi';.

TextExtracts as the description source

Enable the TextExtracts extension
Add $wgCitizenSearchDescriptionSource = 'textextracts'; to your LocalSettings.php
Create a page called CitizenXSSTextExtracts and insert <img src="" onerror="alert('citizen search xss')"> into it
Open the search modal and search for CitizenXSSTextExtracts

Description2 as the description source

Enable the Description2 extension
Add $wgEnableMetaDescriptionFunctions = true; to your LocalSettings.php to enable the {{#description2:}} parser function
Add $wgCitizenSearchDescriptionSource = 'pagedescription'; to your LocalSettings.php
Create a page called CitizenXSSDescription2 and insert {{#description2:<img src="" onerror="alert('citizen search xss 2')">}} into it
Open the search modal and search for CitizenXSSDescription2

Wikibase as the description source

Note that this method is currently untested due to issues I experienced when setting up Wikibase.

Enable Wikibase client + repo in your wiki
Add $wgCitizenSearchDescriptionSource = 'wikidata'; to your LocalSettings.php
Have an item with a description like <img src="" onerror="alert('citizen search xss 3')">
Open the search modal and search for the page linked to the item

ShortDescription as the description source

Enable the ShortDescription extension
Add $wgCitizenSearchDescriptionSource = 'wikidata'; to your LocalSettings.php
Create a page called CitizenXSSDescription4 and insert {{SHORTDESC:<img src="" onerror="alert('citizen search xss 4')">}} into it
Open the search modal and search for CitizenXSSDescription4

Impact

On all wikis that use the aforementioned settings (command palette disabled or using an old release where the old search bar is still used; using the action API as the search gateway), anybody who can edit pages is able to insert XSS payloads into the DOM for other users who are searching for specific pages.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "starcitizentools/citizen-skin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.4"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53368"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-03T20:29:08Z",
    "nvd_published_at": "2025-07-03T20:15:23Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nPage descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar.\n\n### Details\n\nThe descriptions, which are unsanitized, are inserted as raw HTML:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d4dfc3697a82948b3b9c4d44e9a273c79bc86b87/resources/skins.citizen.search/templates/TypeaheadListItem.mustache#L18\n\n### PoC\n\n\nAll of the reproduction methods require the command palette to be disabled via `$wgCitizenEnableCommandPalette = false;`.\nAdditionally, the action API must be used as the Search Gateway via  `$wgCitizenSearchGateway = \u0027mwActionApi\u0027;`.\n\n\n#### TextExtracts as the description source\n\n* Enable the TextExtracts extension\n* Add `$wgCitizenSearchDescriptionSource = \u0027textextracts\u0027;` to your LocalSettings.php\n* Create a page called `CitizenXSSTextExtracts` and insert `\u003cimg src=\"\" onerror=\"alert(\u0027citizen search xss\u0027)\"\u003e` into it\n* Open the search modal and search for `CitizenXSSTextExtracts`\n\n![image](https://github.com/user-attachments/assets/fbc88458-c429-4f08-9376-584b7db93f58)\n\n\n#### Description2 as the description source\n\n* Enable the Description2 extension\n* Add `$wgEnableMetaDescriptionFunctions = true;` to your LocalSettings.php to enable the `{{#description2:}}` parser function\n* Add `$wgCitizenSearchDescriptionSource = \u0027pagedescription\u0027;` to your LocalSettings.php\n* Create a page called `CitizenXSSDescription2` and insert `{{#description2:\u003cimg src=\"\" onerror=\"alert(\u0027citizen search xss 2\u0027)\"\u003e}}` into it\n* Open the search modal and search for `CitizenXSSDescription2`\n\n![image](https://github.com/user-attachments/assets/24513eba-dbec-4bc6-ac06-6276d509fcab)\n\n\n#### Wikibase as the description source\n\nNote that this method is currently untested due to issues I experienced when setting up Wikibase.\n\n* Enable Wikibase client + repo in your wiki\n* Add `$wgCitizenSearchDescriptionSource = \u0027wikidata\u0027;` to your LocalSettings.php\n* Have an item with a description like `\u003cimg src=\"\" onerror=\"alert(\u0027citizen search xss 3\u0027)\"\u003e`\n* Open the search modal and search for the page linked to the item\n\n\n#### ShortDescription as the description source\n\n* Enable the ShortDescription extension\n* Add `$wgCitizenSearchDescriptionSource = \u0027wikidata\u0027;` to your LocalSettings.php\n* Create a page called `CitizenXSSDescription4` and insert `{{SHORTDESC:\u003cimg src=\"\" onerror=\"alert(\u0027citizen search xss 4\u0027)\"\u003e}}` into it\n* Open the search modal and search for `CitizenXSSDescription4`\n\n### Impact\n\nOn all wikis that use the aforementioned settings (command palette disabled or using an old release where the old search bar is still used; using the action API as the search gateway), anybody who can edit pages is able to insert XSS payloads into the DOM for other users who are searching for specific pages.",
  "id": "GHSA-rq6g-6g94-jfr4",
  "modified": "2025-07-03T21:51:57Z",
  "published": "2025-07-03T20:29:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53368"
    },
    {
      "type": "WEB",
      "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen"
    },
    {
      "type": "WEB",
      "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions"
}

CVE-2025-53368 (GCVE-0-2025-53368)

Vulnerability from cvelistv5 – Published: 2025-07-03 19:34 – Updated: 2025-07-03 19:50

Title

Citizen is vulnerable to stored XSS attack in the legacy search bar

Summary

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-03 19:50 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7793 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/StarCitizenTools/mediawiki-ski…	x_refsource_CONFIRM
https://github.com/StarCitizenTools/mediawiki-ski…	x_refsource_MISC
https://github.com/StarCitizenTools/mediawiki-ski…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
StarCitizenTools	mediawiki-skins-Citizen	Affected: >= 1.9.4, < 3.4.0 Affected: >= b2bd79196db1153d0bc1bd51a646d957cbdf4aec, < aedbceb3380bb48db6b59e272fc187529c71c8ca

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53368",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-03T19:50:31.799305Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-03T19:50:44.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mediawiki-skins-Citizen",
          "vendor": "StarCitizenTools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.9.4, \u003c 3.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= b2bd79196db1153d0bc1bd51a646d957cbdf4aec, \u003c aedbceb3380bb48db6b59e272fc187529c71c8ca"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-03T19:34:50.057Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4"
        },
        {
          "name": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca"
        },
        {
          "name": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rq6g-6g94-jfr4",
        "discovery": "UNKNOWN"
      },
      "title": "Citizen is vulnerable to stored XSS attack in the legacy search bar"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53368",
    "datePublished": "2025-07-03T19:34:50.057Z",
    "dateReserved": "2025-06-27T12:57:16.121Z",
    "dateUpdated": "2025-07-03T19:50:44.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-RQ6G-6G94-JFR4

Summary

Details

PoC

TextExtracts as the description source

Description2 as the description source

Wikibase as the description source

ShortDescription as the description source

Impact

CVE-2025-53368 (GCVE-0-2025-53368)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour