CVE-2023-46732: Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
Impact
XWiki is vulnerable to reflected cross-site scripting (RXSS) via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation.
The vulnerability can be demonstrated by opening <xwiki-host>/xwiki/bin/view/Main/?rev=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F15.5%25%25%22%3e%3cscript%3ealert(1)%3c%2fscript%3e where <xwiki-host> is the URL of your XWiki installation. If an alert is displayed, the installation is vulnerable.
Patches This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14.
Workarounds The patch can be manually applied without upgrading (or restarting) the instance.
References https://jira.xwiki.org/browse/XWIKI-21095 https://github.com/xwiki/xwiki-platform/commit/04e325d57d4bcb6ab79bddcafbb19032474c2a55
Attribution
We thank Agostino Parentela, Vulnerability Management Engineer of TicketOne S.p.A., agostino.parentela@ticketone.it for reporting this vulnerability.
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit 04e325d57 can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-46732?
CVE-2023-46732 is a vulnerability in XWiki that allows for reflected cross-site scripting (RXSS) through the 'rev' parameter in the content menu, potentially enabling an attacker to execute arbitrary actions.
What is the impact of CVE-2023-46732?
The impact of CVE-2023-46732 is that an attacker can exploit the vulnerability to execute arbitrary actions in the context of the user's session.
How can an attacker exploit CVE-2023-46732?
An attacker can exploit CVE-2023-46732 by convincing a user to visit a link with a crafted 'rev' parameter, triggering the execution of arbitrary actions.
Which versions of XWiki are affected by CVE-2023-46732?
XWiki versions 9.7-rc-1 through 15.5.1 (excluding 15.5.1) of the 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources' package are affected by CVE-2023-46732.
How do I fix CVE-2023-46732?
To fix CVE-2023-46732, update to version 15.5.1 or later of the 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources' package.