CVE-2021-43841: XSS by SVG upload in xwiki-platform
Impact When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file.
Patches This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.
Workarounds This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload
References https://jira.xwiki.org/browse/XWIKI-18368
For more information If you have any questions or comments about this advisory: Open an issue in Jira Email us at security ML
Other sources
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43841?
CVE-2021-43841 is categorized as a medium severity vulnerability due to its potential for script execution through uploaded SVG files.
How do I fix CVE-2021-43841?
To mitigate CVE-2021-43841, upgrade to the patched versions 12.10.6 or 13.3RC1 of the affected XWiki packages.
What products are affected by CVE-2021-43841?
CVE-2021-43841 affects XWiki versions prior to 12.10.6 and between 13.0 and 13.2.
What type of attack does CVE-2021-43841 enable?
CVE-2021-43841 enables attackers to upload malicious SVG files that can execute scripts upon file download.
Is there a workaround for CVE-2021-43841?
While upgrading is recommended, enforcing strict file type validations may serve as a temporary workaround for CVE-2021-43841.