Executive Summary

CVE-2025-59839 is a stored Cross-Site Scripting (XSS) vulnerability in the MediaWiki EmbedVideo extension (versions 4.0.0 and prior). The extension allowed users to add arbitrary HTML attributes to iframe elements via a data attribute named 'data-iframeconfig' through wikitext. This enabled attackers to inject malicious JavaScript code that would execute in other users' browsers when they viewed the affected wiki pages. The vulnerability arises because the extension's JavaScript reads JSON from this attribute and applies it as iframe attributes, including dangerous event handlers like 'onload', leading to stored XSS attacks. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the browsers of users who view the affected wiki pages. This can lead to session hijacking, data theft, or other malicious actions performed in the context of the victim's session. Since the attack is stored XSS, the malicious code persists on the server and affects all users who access the compromised content. The vulnerability has a high severity with a CVSS score of 8.6, indicating significant risk. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by searching for wiki pages containing the vulnerable EmbedVideo extension usage with the 'data-iframeconfig' attribute in HTML elements, especially divs with class 'embedvideo-evl'. You can look for occurrences of 'data-iframeconfig' in your MediaWiki content or database. Additionally, inspecting rendered pages for elements with 'data-iframeconfig' attributes or monitoring network traffic for such payloads may help. For example, you can use grep or similar commands on your MediaWiki content files or database exports: 1) grep -r 'data-iframeconfig' /path/to/mediawiki 2) Use SQL queries to find pages containing 'data-iframeconfig' in the wikitext. Also, testing with crafted HTML like `<div class="embedvideo-evl" data-iframeconfig='{"onload": "alert(1)"}'>Click me!</div>` can confirm if the vulnerability is present. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the EmbedVideo extension to a version that includes the patch which renames the vulnerable 'data-iframeconfig' attribute to 'data-mw-iframeconfig', as done in commit 4e075d3. This patch prevents arbitrary HTML attribute injection via wikitext. If updating is not immediately possible, restrict editing permissions to trusted users to prevent injection of malicious wikitext, and consider sanitizing or removing any existing content using the 'data-iframeconfig' attribute. Monitoring and removing suspicious pages containing this attribute can also reduce risk. [1]

Useful 0 Not Useful 0