CVE-2024-25107: Miraheze WikiDiscover XSS Vulnerability

CVE-2024-25107 Overview

CVE-2024-25107 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Miraheze WikiDiscover extension for MediaWiki. The flaw exists in the Special:WikiDiscover page, where the Language::date function outputs unescaped interface messages when rendering the wiki_creation column. An attacker with the (editinterface) right can inject malicious content through translated month or day names, which is then rendered without HTML escaping.

Critical Impact
Authenticated users with the (editinterface) permission can inject arbitrary JavaScript into the WikiDiscover special page, executing in the context of any visitor's browser session.

Affected Products

Miraheze WikiDiscover extension (all versions prior to commit 267e763a0)
MediaWiki installations using WikiDiscover with CreateWiki managed farms
Miraheze-hosted wiki farms deploying the vulnerable extension

Discovery Timeline

2024-02-08 - CVE-2024-25107 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25107

Vulnerability Analysis

The vulnerability resides in includes/WikiDiscoverWikisPager.php within the wiki_creation case of the column formatter. The code calls $lang->date() to produce a human-readable timestamp for each wiki's creation date. This function relies on MediaWiki interface messages to translate month and day names into the target language.

The Language::date function invokes ->text() output mode internally, returning raw, unescaped interface message content. The WikiDiscover extension then embeds this output directly into HTML without applying htmlspecialchars() or equivalent escaping. Users holding the (editinterface) right can modify these interface messages through the MediaWiki: namespace, injecting arbitrary HTML or JavaScript payloads.

Because the injected content renders on Special:WikiDiscover, a page frequently visited by other users and administrators, the payload executes in every visitor's browser session. This enables session hijacking, credential theft, or forced administrative actions via CSRF.

Root Cause

The root cause is missing output encoding on data returned by Language::date. The ->text() mode returns unescaped translations, and the calling code assumed the output was safe for HTML context. Trust in an internal API's output without contextual escaping produced the injection sink.

Attack Vector

An authenticated attacker with the (editinterface) right edits a translation message for a month or day name in the MediaWiki: namespace, embedding a script payload. When any user browses Special:WikiDiscover, the pager renders the tainted string into the HTML response and the browser executes the injected script.

php

// Patch from commit 267e763a0 - includes/WikiDiscoverWikisPager.php
case 'wiki_creation':
    $lang = RequestContext::getMain()->getLanguage();

-    $formatted = $lang->date( wfTimestamp( TS_MW, strtotime( $row->wiki_creation ) ) );
+    $formatted = htmlspecialchars( $lang->date( wfTimestamp( TS_MW, strtotime( $row->wiki_creation ) ) ) );
    break;
case 'wiki_description':
    $manageWikiSettings = new ManageWikiSettings( $wiki );

Source: GitHub commit 267e763a0. The fix wraps the Language::date output in htmlspecialchars() to neutralize HTML metacharacters before inclusion in the response.

Detection Methods for CVE-2024-25107

Indicators of Compromise

Unexpected edits to interface messages in the MediaWiki: namespace, particularly to month or day name translations (e.g., MediaWiki:January, MediaWiki:Monday).
HTML tags, <script> elements, or event handlers appearing within language message content.
Anomalous JavaScript execution or outbound requests originating from Special:WikiDiscover page loads.

Detection Strategies

Audit the MediaWiki logging table for editinterface actions targeting date-related messages.
Compare current interface message contents against upstream defaults to identify unauthorized modifications.
Deploy Content Security Policy (CSP) headers to detect and block inline script execution on wiki pages.

Monitoring Recommendations

Alert on privilege grants that add editinterface to user groups outside of scheduled administrative changes.
Log and review all edits to the MediaWiki: namespace with reviewer sign-off for translation changes.
Monitor web server access logs for repeated automated requests to Special:WikiDiscover that may indicate exploitation attempts.

How to Mitigate CVE-2024-25107

Immediate Actions Required

Update the WikiDiscover extension to a version containing commit 267e763a0 or later.
Review the list of users holding the (editinterface) right and remove the permission from any account that does not require it.
Inspect existing interface messages in the MediaWiki: namespace for injected HTML or script content and revert malicious edits.

Patch Information

The vulnerability is fixed in commit 267e763a0. Details are published in GitHub Security Advisory GHSA-cfcf-94jv-455f and tracked at Miraheze Issue T11814. Administrators should pull the latest WikiDiscover code from the official repository and redeploy.

Workarounds

No official workaround exists per the vendor advisory; patching is the only supported remediation.
As an interim risk-reduction measure, restrict the (editinterface) right to a minimal, trusted set of administrators.
Enforce a strict Content Security Policy that disallows inline scripts to reduce impact if exploitation occurs.

bash

# Apply the WikiDiscover security patch
cd /path/to/mediawiki/extensions/WikiDiscover
git fetch origin
git checkout master
git pull origin master
# Verify the fix commit is present
git log --oneline | grep 267e763a0