CVE-2025-53369 in mediawiki-extensions-ShortDescription
Summary
by MITRE • 07/03/2025
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/04/2025
The vulnerability identified as CVE-2025-53369 affects the Short Description MediaWiki extension, specifically impacting version 4.0.0 where inadequate input sanitization creates a persistent cross-site scripting vulnerability. This flaw exists within the extension's handling of user-provided content when rendering short descriptions on wiki pages. The issue stems from the extension's failure to properly sanitize user input before incorporating it into the Document Object Model through the mw.util.addSubtitle JavaScript function, which is designed for adding subtitle content to pages. When users edit pages containing short descriptions, the system processes their input without sufficient validation or sanitization measures, creating an opportunity for malicious actors to inject arbitrary HTML code directly into the page structure.
The technical exploitation of this vulnerability occurs through the manipulation of page edit functionality within MediaWiki's interface, where any authenticated user can modify content and insert malicious HTML payloads. The flaw directly relates to CWE-79 which categorizes cross-site scripting vulnerabilities resulting from insufficient input sanitization. The mw.util.addSubtitle function serves as the vector through which malicious HTML content bypasses normal security controls, allowing attackers to inject scripts, style tags, or other HTML elements that execute within the context of other users' browsers. This creates a persistent threat where legitimate users who visit affected pages become victims of the injected malicious code, potentially leading to session hijacking, data theft, or further exploitation of the MediaWiki instance.
The operational impact of this vulnerability extends beyond simple content manipulation, as it represents a significant security risk for organizations relying on MediaWiki for collaborative content management. Attackers can leverage this vulnerability to execute arbitrary code in the browsers of other users, potentially compromising user sessions and accessing sensitive information. The vulnerability affects all users who have edit permissions to pages containing short descriptions, making it particularly dangerous in environments where multiple users contribute content. The attack surface includes not only the direct injection of HTML but also potential escalation to more serious security incidents such as privilege escalation or data exfiltration. Organizations using MediaWiki with the Short Description extension are particularly vulnerable if they do not immediately patch to version 4.0.1, which contains the necessary sanitization fixes.
Mitigation strategies should focus on immediate patching to version 4.0.1, which implements proper HTML sanitization before content insertion. System administrators should also consider implementing additional security measures such as Content Security Policy headers to limit the execution of inline scripts and restrict the sources from which content can be loaded. Regular security audits of MediaWiki extensions should be conducted to identify similar vulnerabilities in other components, particularly those handling user-generated content. The ATT&CK framework categorizes this vulnerability under T1556.001 for credential access through the exploitation of web application vulnerabilities, and T1059.001 for command and control through the execution of malicious code in web browsers. Organizations should also implement proper input validation at multiple layers and consider restricting user permissions for content editing where possible, particularly for sensitive wiki environments where unauthorized content modification could have significant operational impacts.