CVE-2025-43861
📋 TL;DR
ManageWiki extension for MediaWiki has a cross-site scripting vulnerability where logged-in attackers can inject malicious scripts into form fields. When the 'Review Changes' dialog is opened, the payload executes in the victim's session context. This affects all MediaWiki installations using vulnerable ManageWiki versions.
💻 Affected Systems
- ManageWiki MediaWiki extension
📦 What is this software?
Managewiki by Miraheze
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals admin session cookies, performs unauthorized actions, or compromises user accounts through session hijacking.
Likely Case
Attacker performs limited session hijacking or defacement within the affected user's permissions.
If Mitigated
Minimal impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploitation requires attacker to be logged in and have access to modify form fields, then trigger the review dialog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 2f177dc or later
Vendor Advisory: https://github.com/miraheze/ManageWiki/security/advisories/GHSA-859x-46h8-vcrv
Restart Required: No
Instructions:
1. Update ManageWiki to commit 2f177dc or later. 2. Apply the patch from GitHub. 3. Clear any cached data. 4. Verify the fix by testing the review dialog functionality.
🔧 Temporary Workarounds
Disable ManageWiki extension
allTemporarily disable the ManageWiki extension until patched
Edit LocalSettings.php and comment out wfLoadExtension('ManageWiki');
Restrict user permissions
allLimit which users can access ManageWiki functionality
Configure MediaWiki permissions to restrict ManageWiki access to trusted users only
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution
- Enable MediaWiki's built-in XSS protection features
🔍 How to Verify
Check if Vulnerable:
Check ManageWiki version against commit hash 2f177dc. If earlier, vulnerable.Check Version:
Check git log or extension version in MediaWiki configurationVerify Fix Applied:
Test the review dialog with script payloads to ensure they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual form submissions with script tags
- Multiple review dialog accesses from same user
Network Indicators:
- Script injection patterns in HTTP requests
SIEM Query:
Search for pattern: *<script>* in form field submissions to ManageWiki endpoints