CVE-2025-25287

Executive Summary

CVE-2025-25287 is a stored cross-site scripting (XSS) vulnerability in the Lakeus skin for MediaWiki. The vulnerability allows users with the (editinterface) right to inject arbitrary HTML and JavaScript through system messages, specifically lakeus-footermessage and messages used in themeDesigner.js. While the privilege requirement is high (editinterface), successful exploitation can lead to persistent XSS affecting all users viewing the footer or users who enable the theme designer in their preferences. The CVSS score is 4.7 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. The patch is available in versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a MediaWiki skin (Lakeus) distributed via the MediaWiki extension repository. The risk is limited to MediaWiki instances that have the Lakeus skin installed and configured.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker needs the editinterface right.
• User Interaction (UI): Required (R) - A user must view the affected page (footer) or enable the theme designer.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: Medium. The high privilege requirement reduces the likelihood of exploitation, but the stored XSS can have significant impact on users if exploited.

Deep Dive & Mechanics

The Lakeus skin uses system messages to render dynamic content in the footer and theme designer. The vulnerability arises because these messages are not properly escaped before being rendered in the HTML. Specifically, the lakeus-footermessage is rendered directly in the footer without sanitization. Similarly, messages used in themeDesigner.js are processed without proper escaping.

An attacker with editinterface rights can modify these system messages to include malicious JavaScript. When a user visits a page that uses the Lakeus skin, the malicious script executes in the context of the user's session. This can lead to session hijacking, defacement, or redirection to malicious sites.

The vulnerable code path is in the skin's rendering logic, where system messages are output directly into the HTML without using MediaWiki's built-in escaping functions like htmlspecialchars() or $parser->recursiveTagParse() with proper context.

Vulnerable vs. Patched Code

Vulnerable Code (Lakeus < 1.3.1+REL1.39):

// In includes/LakeusTemplate.php
public function execute() {
    // ...
    $footerMessage = $this->getMsg( 'lakeus-footermessage' );
    // Direct output without escaping
    echo $footerMessage;
    // ...
}

Patched Code (Lakeus >= 1.3.1+REL1.39):

// In includes/LakeusTemplate.php
public function execute() {
    // ...
    $footerMessage = $this->getMsg( 'lakeus-footermessage' );
    // Properly escape the message
    echo htmlspecialchars( $footerMessage, ENT_QUOTES, 'UTF-8' );
    // ...
}

The patch ensures that all system messages are escaped using htmlspecialchars() before being rendered, preventing the injection of raw HTML and JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A MediaWiki instance with the Lakeus skin installed (version 1.0.8 to 1.3.0).
• An account with editinterface rights.

Exploitation Steps:

1. Log in to the MediaWiki instance with an account that has editinterface rights.
2. Navigate to the system message editor (e.g., Special:AllMessages).
3. Edit the message lakeus-footermessage and inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the message.
5. Any user visiting a page that uses the Lakeus skin will see the alert box.

Advanced Payload:

<script>
fetch('/api.php?action=query&meta=tokens&type=csrf').then(r=>r.json()).then(d=>{
    fetch('/api.php?action=logout&token='+d.query.tokens.csrftoken);
});
</script>

Blue Team

Detection Steps:

1. Monitor for changes to system messages, especially lakeus-footermessage and messages in themeDesigner.js.
2. Review audit logs for editinterface actions on these messages.
3. Inspect the rendered HTML of the Lakeus skin footer for unexpected script tags or event handlers.

Hunting Query (Splunk):

index=main sourcetype=mediawiki_log
| search action="edit" AND target="MediaWiki:Lakeus-footermessage"
| table _time, user, target, comment

Indicators of Compromise (IOCs)

• File: includes/LakeusTemplate.php (vulnerable version)
• System Message: lakeus-footermessage containing <script> tags or event handlers.
• Network: Outbound connections to attacker-controlled domains from MediaWiki server.
• Log: Audit log entries showing edits to MediaWiki:Lakeus-footermessage or MediaWiki:Lakeus-themedesigner-* messages.

Detection Engineering

YARA Rule

rule CVE_2025_25287_Lakeus_XSS {
    meta:
        description = "Detects vulnerable Lakeus skin code with unescaped system messages"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25287"
    strings:
        $vuln_func = "getMsg( 'lakeus-footermessage' )" nocase
        $vuln_echo = "echo $footerMessage" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-25287 - Lakeus Skin Stored XSS via System Messages
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects edits to Lakeus system messages that may contain XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    product: mediawiki
    service: audit
detection:
    selection:
        action: "edit"
        target|startswith: "MediaWiki:Lakeus-"
    condition: selection
falsepositives:
    - Legitimate edits by trusted administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-25287 - Lakeus Skin XSS Payload in Footer"; flow:to_server,established; content:"lakeus-footermessage"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Lakeus skin to version 1.3.1+REL1.39, 1.3.1+REL1.42, or 1.4.0.
2. If immediate update is not possible, restrict editinterface rights to only trusted users.
3. Review and sanitize existing system messages for any malicious content.

Long-term Measures:

1. Implement a Web Application Firewall (WAF) rule to block XSS payloads in system message edits.
2. Enable Content Security Policy (CSP) headers to mitigate the impact of XSS.
3. Conduct regular security audits of MediaWiki extensions and skins.

Patch Verification:

# Check installed version of Lakeus skin
grep "Lakeus" /path/to/mediawiki/skins/Lakeus/extension.json | grep version

Valters IT
Securing Digital Frontiers