PT-2023-26177 · Xwiki · Xwiki

Michael Hamann · Published 2023-05-11 · Updated 2023-10-31 · CVE-2023-37908

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions 14.6-rc-1 through 14.10.3 XWiki versions prior to 15.0 RC1

Description The issue concerns the cleaning of attributes during XHTML rendering in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited via the link syntax in any content that supports XWiki syntax, such as comments in XWiki. When a user moves the mouse over a malicious link, the malicious JavaScript code is executed in the context of the user session. If the user is a privileged user with programming rights, this allows server-side code execution with programming rights, impacting the confidentiality, integrity, and availability of the XWiki instance. The attribute was correctly recognized as not allowed but was still printed with a prefix data-xwiki-translated-attribute- without further cleaning or validation.

Recommendations For XWiki versions 14.6-rc-1 through 14.10.3, upgrade to XWiki 14.10.4 or later. For XWiki versions prior to 15.0 RC1, upgrade to 15.0 RC1 or later. As a temporary workaround, consider disabling the link syntax in XWiki syntax to minimize the risk of exploitation. Restrict access to privileged users with programming rights to reduce the impact of potential server-side code execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-86

CWE-83

Related Identifiers

CVE-2023-37908

GHSA-663W-2XP3-5739

GHSA-6GF5-C898-7RXP

Affected Products

Xwiki

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37908.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739 · Exploit
• 🔥 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp · Exploit
• 🔥 https://jira.xwiki.org/browse/XRENDERING-697 · Exploit
• https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37908 · Security Note
• https://osv.dev/vulnerability/GHSA-663w-2xp3-5739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32070 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6gf5-c898-7rxp · Vendor Advisory
• https://github.com/xwiki/xwiki-rendering · Note
• https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 · Note
• https://t.me/cibsecurity/72850 · Telegram Post
• https://twitter.com/cracbot/status/1717535474254753798 · Twitter Post
• https://jira.xwiki.org/browse/XRENDERING-663 · Note