DiscordNotifications erlaubt DoS, SSRF und möglicherweise RCE durch Anfragen an benutzergesteuerte URLs

The DiscordNotifications extension, designed to send MediaWiki actions to Discord, introduces a significant security risk due to its handling of external URLs. The vulnerability lies in the use of curl and filegetcontents to fetch data from URLs specified in $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. An attacker can craft malicious URLs that, when accessed by the MediaWiki server, trigger the execution of arbitrary code on the server. This could involve downloading and executing a malicious script, or directly injecting commands into the server's environment. The SSRF component allows access to internal APIs, potentially escalating the attack to RCE. The blast radius extends to the entire MediaWiki installation and potentially the underlying server infrastructure, depending on the server's configuration and privileges.

MediaWiki installations utilizing the DiscordNotifications extension are at risk, particularly those with publicly accessible webhooks or those lacking robust input validation. Shared hosting environments where multiple MediaWiki instances share resources are also at increased risk, as a compromise of one instance could potentially impact others.

• php: Examine MediaWiki configuration files for unusual or externally-facing URLs in $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls.

<?php
  // Check for unusual URLs in configuration
  if (strpos($_SERVER['REQUEST_URI'], 'wgDiscordIncomingWebhookUrl') !== false) {
    echo 'Potential vulnerability detected!';
  }
?>

• generic web: Monitor access logs for requests to unusual or unexpected URLs originating from the MediaWiki server. • generic web: Check response headers for signs of SSRF attempts (e.g., unexpected server names or IP addresses).

1. 2025-07-10Disclosure

   disclosure

1. Reserviert2025-06-27
2. Veröffentlicht2025-07-10
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-53371 is to immediately upgrade the DiscordNotifications extension to version 1f20d850cbcce5b15951c7c6127b87b927a5415e or later. If an immediate upgrade is not feasible, consider temporarily disabling the DiscordNotifications extension to prevent exploitation. As a secondary measure, implement strict input validation and sanitization for all URLs used in the $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls configuration variables. Web Application Firewalls (WAFs) can be configured to block requests to suspicious URLs or those originating from untrusted sources. After upgrading, confirm the fix by attempting to access a known malicious URL and verifying that it does not trigger code execution.