CVE-2020-25814

Vulnerability

Overview

CVE-2020-25814 is a cross-site scripting (XSS) vulnerability in MediaWiki versions prior to 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The flaw resides in the mediawiki.jqueryMsg module, specifically when processing messages with mw.message().parse(). An attacker can craft a message containing a [javascript:payload xss] link, which is then converted into a jQuery object. Due to insufficient sanitization, the resulting ` tag retains the javascript:` href, executing arbitrary JavaScript when clicked by a victim.[1][2]

Exploitation

Details

An authenticated attacker (or one able to influence a wiki page's message content) can insert a specially crafted wikitext link with a javascript: URI. When MediaWiki's message parser processes this input through mw.message().parse(), it fails to strip or neutralize the dangerous scheme. The output is a jQuery object containing an `` element. Any user interacting with this rendered content—by clicking the resulting link—triggers script execution in their browser session. No special privileges beyond the ability to edit or create pages with such messages are required.[2][3]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's MediaWiki session. This can lead to session hijacking, defacement, data theft, or performing administrative actions on behalf of the victim. Since the injected script runs with the user's privileges, the impact scales with the victim's permissions, potentially compromising the entire wiki instance.[2]

Mitigation

The vulnerability is fixed in MediaWiki 1.31.10 and 1.34.4. The fix involves sanitizing URLs and the style attribute in the mediawiki.jqueryMsg module. Administrators are strongly advised to upgrade to these patched versions immediately. No workarounds are publicly documented; upgrading is the only secure mitigation.[3][4]