CVE-2025-53480: Mediawiki CheckUser Extension Vulnerable to Reflected XSS

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the CheckUser extension for Mediawiki. This flaw could allow attackers to inject arbitrary web scripts into a user's browser if they can trick the user into clicking a specially crafted link.

Vulnerability Details

• CVE ID: CVE-2025-53480
• Description: The CheckUser extension's Special:Investigate page contains a vulnerability in the Account information tab. Specific internationalized messages are rendered without proper escaping, allowing attackers to inject malicious scripts using the ?uselang=x-xss parameter in the URL.
• CVSS Score: 5.4 (Medium)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• CVSS Explanation:
  • AV:N (Network): The vulnerability is exploitable over the network.
  • AC:L (Low): The attack complexity is low, meaning it's relatively easy to exploit.
  • PR:L (Low): The attacker needs low privileges (e.g., a registered user) to exploit the vulnerability.
  • UI:R (User Interaction Required): User interaction is required, meaning a user needs to click a malicious link.
  • S:C (Changed): The scope is changed because the injected script executes within the context of the vulnerable website.
  • C:L (Low): There is limited impact to confidentiality.
  • I:L (Low): There is limited impact to integrity.
  • A:N (None): There is no impact to availability.
• Exploit Requirements: An attacker needs to craft a malicious URL and trick a logged-in user into clicking it.
• Affected Vendor: Mediawiki
• Affected Product: CheckUser extension
• Affected Versions: 1.39.X before 1.39.13, 1.42.X before 1.42.7, 1.43.X before 1.43.2
• CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Timeline of Events

• 2025-07-08: Vulnerability publicly disclosed.
• [Future Date]: Expected release of patched versions.

Exploitability & Real-World Risk

The reflected XSS vulnerability in the CheckUser extension could be exploited to perform various malicious actions on behalf of the victim user. This includes stealing cookies, performing actions as the user, or redirecting the user to a phishing site. The real-world risk depends on the privileges of the compromised user. An attacker could potentially gain administrative access if an administrator clicks the malicious link.

Recommendations

• Update CheckUser: Upgrade the CheckUser extension to version 1.39.13, 1.42.7, 1.43.2, or later.
• User Awareness: Educate users to be cautious about clicking on links from untrusted sources.
• Input Validation: Ensure all input is properly validated and sanitized to prevent XSS attacks.

Technical Insight

The vulnerability stems from the improper handling of internationalized messages in the Account information tab of the Special:Investigate page. When the uselang parameter is set to x-xss, it triggers the rendering of affected message keys without proper escaping. This allows an attacker to inject arbitrary JavaScript code into the page, which is then executed in the user's browser.

Credit to Researcher(s)

This vulnerability was reported to the Mediawiki security team.

References

• Gerrit Patch
• Phabricator Task

Tags

XSS, Reflected XSS, Mediawiki, CheckUser, Security, CVE-2025-53480

Summary: A reflected XSS vulnerability exists in the Mediawiki CheckUser extension's Special:Investigate page. Attackers can inject malicious scripts by crafting URLs with the `uselang=x-xss` parameter, affecting versions before 1.39.13, 1.42.7, and 1.43.2. Upgrade to the latest version to mitigate this risk.

CVE ID: CVE-2025-53480

Risk Analysis: Successful exploitation of this reflected XSS vulnerability could allow an attacker to steal user session cookies, perform actions on behalf of the user (e.g., change settings, post content), or redirect the user to a phishing page. If an administrator account is compromised, the attacker could gain control over the entire Mediawiki installation.

Recommendation: Upgrade the CheckUser extension to the latest version (1.39.13, 1.42.7, 1.43.2, or later) to patch this vulnerability. Also, educate users about the risks of clicking on untrusted links and consider implementing stricter input validation and output encoding measures to prevent XSS attacks.

Timeline

• 2025-07-08: Vulnerability publicly disclosed

References

• https://gerrit.wikimedia.org/r/q/I777fc55fef15c3b00df0db268af2b64cb2d6e381
• https://phabricator.wikimedia.org/T394700