CVE-2025-7056

Executive Summary

CVE-2025-7056 is a stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's MediaWiki UrlShortener extension. An attacker with the ability to create or edit short URLs can inject malicious scripts that execute in the browsers of other users viewing the shortened link or related pages. This vulnerability affects all installations running the UrlShortener extension on MediaWiki versions 1.42.x before 1.42.7 and 1.43.x before 1.43.2. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing stored XSS payloads to persist and execute.

Supply Chain & Package Security

This vulnerability is specific to the MediaWiki ecosystem and its UrlShortener extension. It is not a supply chain compromise of a package manager (NPM, PyPI, Go, Ruby). The risk is limited to organizations self-hosting MediaWiki with the UrlShortener extension enabled. No malicious packages or compromised dependencies have been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs a valid user account with permission to create short URLs.
• User Interaction (UI): Required – The victim must click on or view the malicious short URL.
• Scope (S): Changed – The impact extends beyond the vulnerable component, affecting the user's browser session.
• Confidentiality (C): Low – Limited information disclosure (e.g., session tokens, cookies).
• Integrity (I): Low – Limited ability to modify content or perform actions on behalf of the victim.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking, phishing, and defacement makes this a significant concern for MediaWiki administrators.

Deep Dive & Mechanics

The UrlShortener extension allows users to create shortened URLs for MediaWiki pages. The vulnerability exists because the extension does not properly sanitize or escape user-supplied input when generating the web page that displays or redirects to the shortened URL. An attacker can craft a short URL containing malicious JavaScript code. When a victim visits this URL, the injected script executes in the context of the victim's browser session on the MediaWiki domain.

Root Cause: The extension fails to apply proper output encoding (e.g., HTML entity encoding) to user-controlled data before rendering it in the HTTP response. This allows an attacker to break out of the intended HTML context and inject arbitrary script tags or event handlers.

Attack Flow:

1. Attacker logs into MediaWiki with an account that has permission to create short URLs.
2. Attacker creates a short URL with a payload in the destination or alias field, e.g., javascript:alert(document.cookie) or <script>/* malicious code */</script>.
3. Attacker distributes the malicious short URL to victims via email, social media, or other channels.
4. Victim clicks the link and the injected script executes, potentially stealing cookies, redirecting to a phishing site, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In UrlShortener extension, before patch
function renderShortUrl($input) {
    // Directly outputs user input without sanitization
    echo "<a href='" . $input . "'>Short URL</a>";
}

Patched Code (Conceptual):

// In UrlShortener extension, after patch
function renderShortUrl($input) {
    // Properly escape output using MediaWiki's built-in escaping functions
    echo "<a href='" . htmlspecialchars($input, ENT_QUOTES, 'UTF-8') . "'>Short URL</a>";
}

The patched version uses htmlspecialchars() or MediaWiki's $this->getOutput()->addHTML() with proper escaping to ensure that user input is treated as text, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A MediaWiki instance with the UrlShortener extension installed (vulnerable version).
• A valid user account with permission to create short URLs.

Exploitation Steps:

1. Log in to the MediaWiki instance.
2. Navigate to the UrlShortener interface (e.g., Special:UrlShortener).
3. Create a new short URL with the following payload in the destination field:

   "><script>alert('XSS')</script>
   

4. Note the generated short URL (e.g., https://wiki.example.com/w/index.php?curid=123).
5. Share this URL with a victim. When the victim visits the URL, the JavaScript executes.

Advanced Payload:

" onmouseover="alert(document.cookie)

This payload executes when the victim hovers over the link.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to Special:UrlShortener with suspicious parameters.
• Look for short URLs containing HTML tags or JavaScript code in the destination field.
• Use WAF rules to block requests containing <script> or onerror= in URL parameters.

Honeypot:

• Deploy a fake MediaWiki instance with the vulnerable extension and monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /w/index.php?title=Special:UrlShortener with parameters containing <script>, onerror, onmouseover, or similar XSS patterns.
  • Outbound connections from the MediaWiki server to unknown IPs (potential data exfiltration).

• File IOCs:

  • Modified or newly created short URL entries in the MediaWiki database (urlshortener_links table) containing JavaScript payloads.

• Log IOCs:

  • Web server logs showing 200 responses to Special:UrlShortener with unusual query strings.
  • MediaWiki debug logs indicating failed input validation.

Detection Engineering

YARA Rule

rule CVE_2025_7056_UrlShortener_XSS {
    meta:
        description = "Detects stored XSS payloads in MediaWiki UrlShortener extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7056"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+["']?/is
        $xss3 = /onmouseover\s*=\s*["']?[^"'\s>]+["']?/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-7056 - Stored XSS in MediaWiki UrlShortener
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in MediaWiki UrlShortener extension
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onmouseover='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in short URLs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7056 - Stored XSS in MediaWiki UrlShortener"; flow:to_server,established; content:"Special:UrlShortener"; http_uri; pcre:"/(<script|onerror=|onmouseover=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the UrlShortener extension to version 1.42.7 (for MediaWiki 1.42.x) or 1.43.2 (for MediaWiki 1.43.x).
2. If immediate upgrade is not possible, disable the UrlShortener extension by removing or renaming the extension directory.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce strict input validation and output encoding for all user-supplied data.
• Regularly update MediaWiki and all extensions to the latest versions.
• Conduct security audits of custom extensions and configurations.

Workaround:

• Restrict the ability to create short URLs to trusted administrators only by modifying user permissions.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal. Always ensure you have proper authorization before testing any system.