CVE-2021-30458: Wikimedia Parsoid XSS Vulnerability
Summary
CVE-2021-30458: Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS). Affects wikimedia/parsoid across 2 version ranges.
< 0.11.1
>= 0.12, < 0.12.2
Fixed in 0.11.1 or 0.12.2, depending on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:11
The same CVE-2021-30458 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wikimedia Parsoid is an open-source software package that provides an API for converting MediaWiki wikitext into HTML. It is used by Wikimedia projects to parse and render wiki pages. The package is written in JavaScript and is available on Packagist. It is widely used by developers to integrate MediaWiki functionality into their applications.
Vulnerability Detail
The vulnerability identified as CVE-2021-30458 affects Wikimedia Parsoid versions before 0.11.1 and 0.12.x before 0.12.2. It is a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject malicious code into the generated HTML output. The vulnerability originates from the Utils/WTUtils.php file, which fails to properly sanitize user-supplied input. By crafting specially crafted wikitext and utilizing a <meta> tag, an attacker can bypass the sanitization steps and potentially execute arbitrary JavaScript code in the context of the victim's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the victim.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.11.10.11.1composer require wikimedia/parsoid:0.11.1 -
>= 0.12, < 0.12.20.12.2composer require wikimedia/parsoid:0.12.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of Wikimedia Parsoid to address the issue.
Conclusion
The XSS vulnerability in Wikimedia Parsoid (CVE-2021-30458) poses a moderate security risk, allowing attackers to inject malicious code into the generated HTML output. To mitigate this risk, it is crucial to upgrade to the latest version of Wikimedia Parsoid (0.12.2 or later). This ensures that user-supplied input is properly sanitized, preventing the execution of arbitrary JavaScript code.
See every vulnerability recorded for wikimedia/parsoid →
FAQ
Wikimedia Parsoid is an open-source software package used for converting MediaWiki wikitext into HTML. It is widely used by Wikimedia projects and developers integrating MediaWiki functionality.
The vulnerability allows an attacker to inject malicious code into the generated HTML output, potentially leading to various security risks such as session hijacking, data theft, and unauthorized actions.
Versions before 0.11.1 and 0.12.x before 0.12.2 are affected by this vulnerability.
Yes, upgrading to the latest version of Wikimedia Parsoid (0.12.2 or later) fixes the vulnerability.
No, there are no known workarounds. Updating to the latest version is the recommended solution.
