CVE-2025-24017: Yeswiki DOM-Based XSS Vulnerability

CVE-2025-24017 Overview

CVE-2025-24017 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting YesWiki, a PHP-based wiki system. Versions up to and including 4.4.5 fail to sanitize non-existent tag values in the search-by-tag feature. Attackers can craft a malicious link that reflects unsanitized input into the page, triggering script execution in the victim's browser when clicked. Successful exploitation enables account takeover, page and comment modification, permission changes, and extraction of user emails. Version 4.5.0 contains the patch. The vulnerability affects the integrity, availability, and confidentiality of any YesWiki instance.

Critical Impact
A single click on a crafted URL grants an attacker session-level control over the victim's YesWiki account, enabling data theft and content tampering.

Affected Products

YesWiki versions up to and including 4.4.5
YesWiki instances exposing the search-by-tag feature
Fixed in YesWiki 4.5.0

Discovery Timeline

2025-01-21 - CVE-2025-24017 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24017

Vulnerability Analysis

The flaw resides in YesWiki's tag search handler. When a user searches for a tag that does not exist, the application reflects the requested tag value directly into the response page without server-side sanitization. Because the reflected value renders in the DOM, an attacker can embed HTML or JavaScript payloads inside the tag parameter of a URL. Clicking the crafted link executes attacker-controlled script in the victim's browser under the YesWiki origin.

The payload runs with the victim's authenticated session context. This allows the attacker to hijack session cookies, invoke administrative actions, read stored emails, and modify wiki pages, comments, and permissions. User interaction is required, but no privileges are needed to generate the malicious link.

Root Cause

The root cause is missing output encoding on user-controlled input in the tag search flow. The commit fixing the issue introduces htmlspecialchars() on reflected filename values in tools/attach/libs/attach.lib.php and improves sanitization inside tools/tags/services/TagsManager.php. The absence of context-appropriate encoding on server-rendered values allowed attacker input to break out of expected HTML contexts.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker crafts a URL pointing to the YesWiki tag search endpoint with a malicious payload in the tag parameter. The attacker delivers the URL through phishing, forum posts, or wiki comments. When an authenticated victim clicks the link, the payload executes and can exfiltrate session data or perform actions on behalf of the user.

php

// Patch excerpt: tools/attach/libs/attach.lib.php
public function showFileNotExits()
{
-    echo '<a href="' . $this->wiki->href('upload', $this->wiki->GetPageTag(), "file=$this->file") . '" class="btn btn-primary"><i class="fa fa-upload icon-upload icon-white"></i> ' . _t('UPLOAD_FILE') . ' ' . $this->file . '</a>';
+    $filename = htmlspecialchars($this->file);
+    echo '<a href="' . $this->wiki->href('upload', $this->wiki->GetPageTag(), "file=$filename") . '" class="btn btn-primary"><i class="fa fa-upload icon-upload icon-white"></i> ' . _t('UPLOAD_FILE') . ' ' . $this->file . '</a>';
}
// Source: https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b

Detection Methods for CVE-2025-24017

Indicators of Compromise

Web server access logs containing tag search requests with <script>, onerror=, onload=, or encoded JavaScript payloads in query parameters
Unexpected outbound requests from user browsers to attacker-controlled domains following YesWiki page visits
Unusual account activity such as permission changes, mass edits, or comment modifications from otherwise inactive accounts
Session cookie usage from geographically anomalous source addresses shortly after users clicked external links

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected XSS payload patterns in YesWiki tag search parameters
Search HTTP request logs for tag search URLs containing HTML entities, angle brackets, or event handler attributes
Correlate wiki audit logs with user login source addresses to identify session reuse from unexpected clients
Monitor for administrative actions (permission grants, user data exports) performed shortly after tag search page loads

Monitoring Recommendations

Enable verbose HTTP logging on the YesWiki front-end and forward logs to a central analytics platform for query on suspicious patterns
Alert on Content Security Policy (CSP) violation reports referencing inline script execution
Track version strings of deployed YesWiki instances and alert on any host still running 4.4.5 or earlier

How to Mitigate CVE-2025-24017

Immediate Actions Required

Upgrade all YesWiki instances to version 4.5.0 or later, which contains the sanitization patch
Invalidate active sessions and force re-authentication after the upgrade to eliminate potentially hijacked sessions
Review wiki audit logs for permission changes, unexpected page edits, or user data exports occurring before the patch
Rotate any credentials or API tokens that may have been exposed through hijacked administrator sessions

Patch Information

The vendor released the fix in commit c1e28b5 and documented the issue in the GitHub Security Advisory GHSA-wphc-5f2j-jhvg. The patch applies htmlspecialchars() to reflected values in tools/attach/libs/attach.lib.php and improves input handling in tools/tags/services/TagsManager.php. Upgrading to YesWiki 4.5.0 remediates the vulnerability.

Workarounds

Restrict access to the YesWiki tag search endpoint via reverse proxy rules until the upgrade is complete
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources on YesWiki pages
Configure the HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of XSS-based session theft

bash

# Example nginx CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;