Vulnerability · Published Apr 15, 2023 · Assigned by GitHub_M
CVE-2023-29201org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Critical 9.1
In plain English
A critical-severity cross-site scripting in xwiki-commons from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.commons:xwiki-commons-xml | 14.6-rc-1 | GHSA-m3jr-cvhj-f35j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-commons | >= 4.2-milestone-1, < 14.6-rc-1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 x_refsource_MISC
- https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 x_refsource_MISC
- https://jira.xwiki.org/browse/XCOMMONS-1680 x_refsource_MISC
- https://jira.xwiki.org/browse/XCOMMONS-2426 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-9118 x_refsource_MISC