CVE-2023-35162: XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template
Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain)
This vulnerability exists since XWiki 6.1-rc-1.
Patches
The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Workarounds
It's possible to workaround the vulnerability by editing the template previewactions.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.
References
Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20342 Introduction of the macro used for fixing this type of vulnerability: https://jira.xwiki.org/browse/XWIKI-20583 Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/9f01166b1a8ee9639666099eb5040302df067e4d
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Attribution
This vulnerability has been reported by René de Sain @renniepak.
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesto a version that resolves this vulnerability.Fixed in 15.1-rc-1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesto a version that resolves this vulnerability.Fixed in 14.10.5 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.10.5 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 15.1-rc-1 - Configuration
Apply the workaround by editing the template previewactions.vm to perform checks on the xcontinue parameter so that payloads such as xcontinue=javascript:alert(document.domain) are not accepted/executed (the advisory notes the real fix requires new APIs).
XWiki preview actions template (previewactions.vm) xcontinue handling/input validation = Perform checks on the xcontinue parameter instead of rendering it directly as part of preview actions logic - Compensating control
As a compensating control until fully patched, mitigate XSS exploitability by preventing or sanitizing access to the previewactions flow that is triggered via xcontinue in the preview actions template (for example, restrict/limit exposure of the preview actions endpoint if your deployment allows network/route access control).
Event History
Frequently Asked Questions
What is CVE-2023-35162?
CVE-2023-35162 is a vulnerability in XWiki Platform that allows users to inject JavaScript into a page (XSS) by crafting a malicious URL.
How severe is CVE-2023-35162?
CVE-2023-35162 has a severity rating of 6.1, which is classified as critical.
Which software versions are affected by CVE-2023-35162?
XWiki versions 6.1, 6.1-milestone1, 6.1-milestone2, 6.1-rc1, and versions 6.2 up to and including 14.10.5 are affected by CVE-2023-35162.
How can I exploit CVE-2023-35162?
You can exploit CVE-2023-35162 by using a crafted URL, such as the previewactions template, to perform a cross-site scripting (XSS) attack.
How can I fix CVE-2023-35162?
To fix CVE-2023-35162, you should upgrade XWiki Platform to a version that is not affected by the vulnerability, such as version 14.10.6 or later.