DiscordNotifications permet des attaques DoS, SSRF et une exécution de code à distance possible via des requêtes vers des URL contrôlées par l'utilisateur

The DiscordNotifications extension, designed to send MediaWiki actions to Discord, introduces a significant security risk due to its handling of external URLs. The vulnerability stems from the extension's use of curl and filegetcontents to send requests to arbitrary URLs specified in $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. An attacker can leverage this to trigger Denial of Service (DoS) attacks by causing the server to read large files. Furthermore, Server-Side Request Forgery (SSRF) becomes possible if internal, unprotected APIs are accessible via HTTP POST requests, potentially escalating to Remote Code Execution. This represents a severe compromise, allowing attackers to gain complete control over the MediaWiki server.

MediaWiki installations utilizing the DiscordNotifications extension are at risk, particularly those with publicly accessible webhooks or those lacking robust input validation. Shared hosting environments where multiple MediaWiki instances share resources are also at increased risk, as a compromise of one instance could potentially impact others.

• php: Examine MediaWiki configuration files for unusual or externally-facing URLs in $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls.

<?php
  // Check for unusual URLs in configuration
  if (strpos($_SERVER['REQUEST_URI'], 'wgDiscordIncomingWebhookUrl') !== false) {
    echo 'Potential vulnerability detected!';
  }
?>

• generic web: Monitor access logs for requests to unusual or unexpected URLs originating from the MediaWiki server. • generic web: Check response headers for signs of SSRF attempts (e.g., unexpected server names or IP addresses).

1. 2025-07-10Disclosure

   disclosure

1. Réservé2025-06-27
2. Publiée2025-07-10
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-53371 is to immediately upgrade the DiscordNotifications extension to version 1f20d850cbcce5b15951c7c6127b87b927a5415e. If upgrading is not immediately feasible, consider temporarily disabling the DiscordNotifications extension. As a secondary measure, implement strict input validation and sanitization for the $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls configuration variables to prevent malicious URL injection. Review and restrict network access to internal APIs to prevent SSRF exploitation. After upgrading, confirm the fix by attempting to trigger a notification with a URL pointing to a non-existent resource; the server should not attempt to access the resource.