CVE-2025-62696
BaseFortify
Publication date: 2025-10-21
Last updated on: 2025-10-21
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mediawiki | springboard_extension | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62696 is a critical security vulnerability in the MediaWiki Springboard extension caused by missing permission checks and lack of input validation in its API. This allows unauthenticated users to execute arbitrary code remotely. Specifically, parameters like sbname, sbtype, sbrepo, sbbranch, and sbcommit are used without sanitization in PHP code and shell commands, enabling attackers to inject and execute malicious PHP and shell commands. This can lead to installing arbitrary extensions and full remote code execution on the server. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized installation of arbitrary extensions, execution of arbitrary PHP and shell commands, and full compromise of the server hosting the MediaWiki Springboard extension. Attackers can gain remote code execution without authentication, potentially leading to data breaches, service disruption, and complete control over the affected system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on monitoring for suspicious API calls to the Springboard extension, especially those using parameters like sbname, sbtype, sbrepo, sbbranch, and sbcommit with unusual or shell-injection-like values. Commands to detect exploitation attempts could include searching web server logs for requests to the Springboard API endpoint containing these parameters with suspicious payloads. For example, using grep on access logs: grep -E 'sbname=|sbtype=|sbrepo=|sbbranch=|sbcommit=' /var/log/apache2/access.log. Additionally, monitoring for unexpected file writes such as creation of files like CustomLoader.php or unusual files (e.g., rce3.txt) in the web root could indicate exploitation. Commands like find /var/www/html -name 'CustomLoader.php' -mtime -1 or tail -f /var/log/apache2/access.log to watch for suspicious requests can be useful. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the Springboard API by enforcing the new 'springboard' permission to prevent unauthenticated access. 2) Apply the patch that restricts API parameters to only allowed extension/skin names and types, and sources other data from a curated YAML file. 3) Validate and sanitize all input parameters (sbname, sbtype, sbrepo, sbbranch, sbcommit) to prevent injection. 4) Monitor and audit the YAML file controlling repositories and commits to ensure it is not maliciously modified. 5) Disable or remove the unused vulnerable delete() function if possible. 6) Review server logs and file system for signs of compromise and unauthorized code execution. These steps align with the fixes merged in Gerrit change 1174003 and the recommendations in the vulnerability report. [1]