ghsa-m3jr-cvhj-f35j
Vulnerability from github
Published
2023-04-12 20:38
Modified
2023-04-25 21:00
Severity ?
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Details

Impact

The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped <script> and <style>-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like <iframe>. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). An example are anonymous comments in XWiki where the HTML macro filters HTML using restricted mode:

javascript {{html}} <a href='' onclick='alert(1)'>XSS</a> {{/html}}

When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.

Patches

This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode.

Workarounds

There are no known workarounds apart from upgrading to a version including the fix.

References

  • https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 - the patch with the filter
  • https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 - the patch with the definitions what is allowed
  • https://jira.xwiki.org/browse/XWIKI-9118 - the security issue with the HTML macro
  • https://jira.xwiki.org/browse/XCOMMONS-1680 - the issue regarding a definition of what is allowed HTML
  • https://jira.xwiki.org/browse/XCOMMONS-2426 - the issue regarding the filter that fixes the security issue

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at XWiki Security mailing-list

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.commons:xwiki-commons-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2-milestone-1"
            },
            {
              "fixed": "14.6-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-29201"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-12T20:38:17Z",
    "nvd_published_at": "2023-04-15T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nThe \"restricted\" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `\u003cscript\u003e` and `\u003cstyle\u003e`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `\u003ciframe\u003e`. As a consequence, any code relying on this \"restricted\" mode for security is vulnerable to JavaScript injection (\"cross-site scripting\"/XSS). An example are anonymous comments in XWiki where the HTML macro filters HTML using restricted mode:\n\n```javascript\n{{html}}\n\u003ca href=\u0027\u0027 onclick=\u0027alert(1)\u0027\u003eXSS\u003c/a\u003e\n{{/html}}\n```\n\nWhen a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.\n\n### Patches\nThis problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode.\n\n### Workarounds\nThere are no known workarounds apart from upgrading to a version including the fix.\n\n### References\n* https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 - the patch with the filter\n* https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 - the patch with the definitions what is allowed\n* https://jira.xwiki.org/browse/XWIKI-9118 - the security issue with the HTML macro\n* https://jira.xwiki.org/browse/XCOMMONS-1680 - the issue regarding a definition of what is allowed HTML\n* https://jira.xwiki.org/browse/XCOMMONS-2426 - the issue regarding the filter that fixes the security issue\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org/)\n* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)",
  "id": "GHSA-m3jr-cvhj-f35j",
  "modified": "2023-04-25T21:00:29Z",
  "published": "2023-04-12T20:38:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29201"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-commons"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XCOMMONS-1680"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XCOMMONS-2426"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-9118"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.