Cross-Site Scripting (XSS) Affecting org.xwiki.platform:xwiki-platform-web-templates package, versions [,14.10.12) [15.0-rc-1,15.5-rc1)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.25% (66th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGXWIKIPLATFORM-6036197
  • published 26 Oct 2023
  • disclosed 25 Oct 2023
  • credit Unknown

How to fix?

Upgrade org.xwiki.platform:xwiki-platform-web-templates to version 14.10.12, 15.5-rc1 or higher.

Overview

org.xwiki.platform:xwiki-platform-web-templates is a Web Resources for the XWiki platform.

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS). An attacker can create a template provider containing malicious code on any document that is part of the wiki. This code is executed when a user selects this template provider during document creation. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.

PoC

  1. As a simple user with no script right, edit the user profile with the object editor and add an object of type "Template Provider Class". Set the name to "My Template", set template to any page on the wiki. In "Creation Restrictions", enter <img onerror="alert(1)" src="https://www.example.com". Accept the suggestion to add this string in the dropdown. Click "Save & View"

  2. As any user with edit right, open <xwiki-host>/xwiki/bin/create/Main/WebHome?parent=&templateprovider=XWiki.<username>&name=foo&spaceReference=Bar, where is the URL of your XWiki installation and is the username of the attacker.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
9 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    Required
  • Scope (S)
    Changed
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

9 critical