CVE-2025-67477: MediaWiki XSS Vulnerability

CVE-2025-67477 Overview

CVE-2025-67477 is an Improper Neutralization of Input During Web Page Generation vulnerability, commonly known as Cross-Site Scripting (XSS), affecting Wikimedia Foundation's MediaWiki platform. The vulnerability exists within the API Sandbox functionality, specifically in the resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.js file. This component handles user interactions with the API testing interface, and improper input sanitization could allow malicious scripts to be injected and executed in the context of other users' sessions.

Critical Impact

Successful exploitation could allow attackers to execute arbitrary JavaScript code in victims' browsers when they access the affected API Sandbox interface, potentially leading to session hijacking, credential theft, or defacement of wiki content.

Affected Products

• MediaWiki versions before 1.44.3
• MediaWiki versions before 1.45.1
• MediaWiki installations utilizing the API Sandbox Special page

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-67477 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67477

Vulnerability Analysis

This Cross-Site Scripting vulnerability occurs due to improper neutralization of user-supplied input within the MediaWiki API Sandbox interface. The API Sandbox is a special page that allows developers and administrators to test API queries directly from the wiki interface. The vulnerable component, ApiSandboxLayout.js, processes user input for constructing and displaying API requests and responses.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-controllable input is not properly sanitized before being rendered in the web page context. This allows an attacker to inject malicious script content that executes when the page is rendered.

The vulnerability requires high privileges to exploit, which limits the attack surface to authenticated users with elevated permissions. However, in wiki environments where administrators or trusted users are targeted, successful exploitation could have significant consequences for content integrity and user privacy.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the ApiSandboxLayout.js JavaScript file. When processing API sandbox parameters or displaying results, the code fails to properly escape or sanitize certain input values before inserting them into the Document Object Model (DOM). This allows specially crafted input containing JavaScript code to be interpreted and executed by the browser rather than being treated as plain text.

Attack Vector

The vulnerability is exploitable over the network, requiring an attacker to craft a malicious request or manipulate input fields within the API Sandbox interface. The attack requires the attacker to have high-level privileges within the MediaWiki installation.

An attacker could construct a specially crafted URL or input sequence containing malicious JavaScript payloads. When a victim with an active session accesses the manipulated API Sandbox page, the injected script executes in their browser context. This could enable the attacker to perform actions on behalf of the victim, steal session cookies, or redirect users to malicious sites.

The vulnerability is associated with the API Sandbox Special page, which is typically accessible to users with API testing permissions. Technical details regarding the specific exploitation mechanism can be found in the Wikimedia Task T406639.

Detection Methods for CVE-2025-67477

Indicators of Compromise

• Unexpected JavaScript execution or browser behavior when accessing the Special:ApiSandbox page
• Unusual URL parameters containing encoded script tags or JavaScript event handlers
• User reports of unexpected redirects or pop-ups when using the API Sandbox functionality
• Web application firewall logs showing XSS payload patterns in requests to API Sandbox endpoints

Detection Strategies

• Deploy web application firewall (WAF) rules to detect common XSS payload patterns in requests to Special:ApiSandbox
• Enable Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Monitor server access logs for requests containing suspicious JavaScript syntax or encoded script elements
• Implement browser-based XSS auditing and ensure it is not disabled for MediaWiki pages

Monitoring Recommendations

• Configure real-time alerting for CSP violation reports from MediaWiki installations
• Review MediaWiki access logs for unusual patterns of API Sandbox usage
• Monitor for unauthorized changes to user sessions or unexpected privilege escalations
• Audit special page access patterns for anomalous behavior from elevated-privilege accounts

How to Mitigate CVE-2025-67477

Immediate Actions Required

• Upgrade MediaWiki installations to version 1.44.3 or later for the 1.44.x branch
• Upgrade MediaWiki installations to version 1.45.1 or later for the 1.45.x branch
• Temporarily restrict access to the Special:ApiSandbox page if immediate patching is not possible
• Review access logs for any evidence of exploitation attempts

Patch Information

Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.44.3 and 1.45.1. Administrators should update their MediaWiki installations to these versions or later to remediate the vulnerability. Detailed information about the fix is available in the Wikimedia Task T406639.

Workarounds

• Implement strict Content Security Policy (CSP) headers that prevent inline script execution
• Restrict access to the API Sandbox feature to only trusted administrators until patching is complete
• Deploy a web application firewall with XSS filtering rules for MediaWiki endpoints
• Consider disabling the API Sandbox extension temporarily if it is not critical to operations

# Example: Restrict API Sandbox access in LocalSettings.php
# Add this configuration to limit access to the API Sandbox special page
$wgGroupPermissions['*']['apisandbox'] = false;
$wgGroupPermissions['user']['apisandbox'] = false;
$wgGroupPermissions['sysop']['apisandbox'] = true;