Summary
The EmbedVideo Extension for MediaWiki can allow cross-site scripting when video URL or identifier input is inserted into an iframe src attribute without sufficient sanitization. When consent enforcement is disabled and a malformed value is processed, an attacker may inject HTML or JavaScript into pages containing the affected embedding functionality.
Affected context
The issue occurs in EmbedVideo deployments using a version before the patched release where $wgEmbedVideoRequireConsent is disabled. Under those conditions, URLs supplied to the #ev parser function or related parser tags may reach an iframe src attribute without adequate output encoding, allowing specially formed values to alter the surrounding markup.
Exploit preconditions
- Attack surface: MediaWiki pages that use EmbedVideo parser functions or tags
- Required access: Ability to submit or influence video URL or identifier input that is rendered by the extension
- Configuration condition:
$wgEmbedVideoRequireConsentmust be disabled - Trigger point: Rendering an iframe from a malformed video URL or identifier
- Why exploitation is possible: Untrusted input can escape the quoted
srcattribute when output is not properly sanitized or encoded
Why this happens
The vulnerability results from inserting externally influenced URL data into an HTML attribute without applying context-appropriate output encoding and validation. A malformed value containing quote characters can terminate the intended src attribute and introduce additional markup or script-capable content. This is consistent with CWE-79: Improper Neutralization of Input During Web Page Generation, with CWE-80: Improper Neutralization of Script-Related HTML Tags also describing the broader HTML and script injection risk.
Potential impact
- An attacker may execute JavaScript in the context of a victim's MediaWiki session
- Malicious content could be injected into pages that render affected embeds
- Session data or page-accessible information could be exposed
- User actions may be performed without the victim's intent
- Site content or administrative workflows could be altered, depending on privileges
General mitigation guidance
Mitigation generally focuses on enforcing safe output handling at the HTML attribute boundary and reducing trust in user-controlled embedding data.
Common defensive patterns include:
- Apply context-aware HTML attribute encoding to all video URLs and identifiers
- Validate URLs against an explicit allowlist of permitted schemes, hosts, and URL formats
- Reject malformed identifiers before template rendering
- Prefer structured URL construction over string concatenation
- Keep consent and security-related configuration enabled by default where practical
- Apply restrictive Content Security Policy controls as defense in depth
- Render embedded content with the least privilege and isolation supported by the platform
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis for unescaped values inserted into HTML attributes
- Code review checks for string concatenation involving iframe or other tag attributes
- Tests using quote characters, malformed URLs, unexpected schemes, and encoded delimiters
- Dynamic scanning of pages that render user-controlled embedding parameters
- Policy enforcement requiring centralized HTML escaping and URL validation helpers
- Automated security review tools configured to detect cross-site scripting and HTML injection patterns
