PT-2023-8621 · Xwiki · Identity-Oauth-Ui

Lucaswitvoet · Published 2023-10-16 · Updated 2023-10-20 · CVE-2023-45144

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com.xwiki.identity-oauth:identity-oauth-ui versions prior to 1.6

Description The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request are vulnerable to XSS and XWiki syntax injection, enabling remote code execution via the groovy macro. This affects the confidentiality, integrity, and availability of the whole XWiki installation.

Recommendations For versions prior to 1.6, upgrade to Identity OAuth version 1.6 to fix the issue. As a temporary workaround, consider restricting access to the groovy macro to minimize the risk of exploitation. There are no known workarounds besides upgrading.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

BDU:2024-01274

CVE-2023-45144

GHSA-H2RM-29CH-WFMH

Affected Products

Identity-Oauth-Ui

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45144.json · Exploit
• https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh · Vendor Advisory
• https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6 · Patch
• https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188 · Patch
• https://bdu.fstec.ru/vul/2024-01274 · Security Note
• https://osv.dev/vulnerability/GHSA-h2rm-29ch-wfmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45144 · Security Note
• https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58 · Note
• https://github.com/xwikisas/identity-oauth · Note
• https://twitter.com/VulmonFeeds/status/1714048436876570633 · Twitter Post
• https://t.me/cibsecurity/72345 · Telegram Post
• https://twitter.com/cracbot/status/1714396850424529373 · Twitter Post
• https://twitter.com/CVEnew/status/1714021693193134126 · Twitter Post
• https://jira.xwiki.org/browse/XWIKI-20719 · Note