CVE-2025-62670: Stored XSS through a system message in FlexDiagrams
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	SomeRandomDeveloper
	Aug 17 2025, 11:08 PM

Project Tags

Referenced Files

	F65769504: T402149.patch
	Aug 17 2025, 11:12 PM

	F65769466: image.png
	Aug 17 2025, 11:08 PM

Subscribers

Description

The flexdiagrams-drawio-saveinfo system message is inserted as HTML by the FlexDiagrams extension, allowing for stored XSS.

Reproduction steps

Create a Drawio diagram
Go to /w/index.php?title=Drawio:Test2&action=editdiagram&uselang=x-xss (make sure to adjust the name of the diagram page, as it has to exist for the vulnerability to work)

Cause

The message is retrieved in the text output mode and inserted through an HtmlSnippet:
https://gerrit.wikimedia.org/g/mediawiki/extensions/FlexDiagrams/+/1ba4aff57096626b3ddb386d8c23c7c384613513/resources/ext.flexdiagrams.drawio.js#116

Additional info

MediaWiki: 1.45.0-alpha (4ad1e30)
Vector: a13cbaa
Flex Diagrams: 1ba4aff

Details

Author Affiliation: Wikimedia Communities

Related Objects

Mentioned In: T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1)
Mentioned Here: rEFLD1ba4aff57096: build: Updating brace-expansion to 1.1.12, 2.0.2
rSVECa13cbaa34fc5: Remove obsolete PHPDoc tags that literally repeat the code
rMW4ad1e30eabe2: Use namespaced GlobalVarConfig in schemas and callbacks

Event Timeline

SomeRandomDeveloper created this task.Aug 17 2025, 11:08 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 17 2025, 11:09 PM

SomeRandomDeveloper claimed this task.Aug 17 2025, 11:09 PM

SomeRandomDeveloper added projects: MediaWiki-extensions-FlexDiagrams, Vuln-XSS, affects-Miraheze.

Patch:

T402149.patch1 KBDownload

flexdiagrams-drawio-saveinfo doesn't contain any HTML, and neither should $( '#wpSave' ).attr( 'value' ), so removing the HtmlSnippet should be fine.

SomeRandomDeveloper added a project: Patch-For-Review.Aug 17 2025, 11:13 PM

SomeRandomDeveloper mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).

@SomeRandomDeveloper - thank you for the diagnosis, and the patch. I checked in your patch here: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlexDiagrams/+/1179692

sbassett removed a project: Patch-For-Review.Aug 18 2025, 2:02 PM

sbassett edited projects, added: SecTeam-Processed; removed: Security-Team.

sbassett added a subscriber: gerritbot.

@Yaron_Koren thanks for merging the patch. Please make sure to use git am to apply my patch next time when uploading it. The commit message 'Simplify code for "Please save" notice for Drawio diagrams' is missing a "SECURITY:" prefix and does not sufficiently state that the commit contains a security fix.

Also the message should have mentioned this task.

Mstyles renamed this task from Stored XSS through a system message in FlexDiagrams to CVE-2025-62670: Stored XSS through a system message in FlexDiagrams.Oct 18 2025, 5:03 AM

Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".

Mstyles changed the edit policy from "Custom Policy" to "All Users".

CVE-2025-62670: Stored XSS through a system message in FlexDiagramsClosed, ResolvedPublicSecurityActions