CVE-2025-49578
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in the Citizen MediaWiki skin where date messages from Language::userDate are inserted into raw HTML without proper sanitization. Attackers with editinterface rights but not editsitejs rights can inject arbitrary HTML into the DOM. This affects MediaWiki installations using the Citizen skin where user groups have interface editing permissions.
💻 Affected Systems
- MediaWiki Citizen skin
📦 What is this software?
Citizen by Starcitizen.tools
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject malicious scripts that steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users, potentially leading to account compromise or data theft.
Likely Case
Attackers with interface editing rights could deface pages, insert malicious links, or steal user session data through stored XSS payloads in date messages.
If Mitigated
With proper user right restrictions (removing editinterface from untrusted groups), impact is limited to administrators who already have full system access.
🎯 Exploit Status
Exploitation requires authenticated users with editinterface rights. The vulnerability is straightforward XSS injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.1
Vendor Advisory: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h
Restart Required: No
Instructions:
1. Update Citizen skin to version 3.3.1 or later. 2. For MediaWiki installations: Navigate to skins/Citizen directory. 3. Run: git pull origin master. 4. Or download latest release from GitHub and replace files. 5. Clear MediaWiki cache if needed.
🔧 Temporary Workarounds
Restrict editinterface rights
allRemove editinterface user right from all groups except trusted administrators who also have editsitejs rights.
Edit LocalSettings.php and modify user rights assignments
Disable Citizen skin
allSwitch to a different MediaWiki skin temporarily until patched.
In LocalSettings.php: $wgDefaultSkin = 'vector';
🧯 If You Can't Patch
- Review and restrict editinterface user rights to only essential trusted users
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check Citizen skin version in skins/Citizen/extension.json or via MediaWiki Special:Version pageCheck Version:
grep -i version skins/Citizen/extension.jsonVerify Fix Applied:
Confirm Citizen skin version is 3.3.1 or higher in extension.json or Special:Version📡 Detection & Monitoring
Log Indicators:
- Unusual interface message edits by non-admin users
- Multiple rapid edits to date-related messages
Network Indicators:
- Unexpected script tags in page responses containing date fields
SIEM Query:
source="mediawiki.log" AND ("editinterface" OR "Special:EditMessages") AND user_group!="sysop"🔗 References
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h
