Cross-Site Scripting (XSS) Affecting org.xwiki.platform:xwiki-platform-web-templates package, versions [,14.10.12) [15.0-rc-1,15.5-rc1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGXWIKIPLATFORM-6036197
- published 26 Oct 2023
- disclosed 25 Oct 2023
- credit Unknown
Introduced: 25 Oct 2023
CVE-2023-45134 Open this link in a new tabHow to fix?
Upgrade org.xwiki.platform:xwiki-platform-web-templates
to version 14.10.12, 15.5-rc1 or higher.
Overview
org.xwiki.platform:xwiki-platform-web-templates is a Web Resources for the XWiki platform.
Affected versions of this package are vulnerable to Cross-Site Scripting (XSS). An attacker can create a template provider containing malicious code on any document that is part of the wiki. This code is executed when a user selects this template provider during document creation. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.
PoC
As a simple user with no script right, edit the user profile with the object editor and add an object of type "Template Provider Class". Set the name to "My Template", set template to any page on the wiki. In "Creation Restrictions", enter <img onerror="alert(1)" src="https://www.example.com". Accept the suggestion to add this string in the dropdown. Click "Save & View"
As any user with edit right, open
<xwiki-host>/xwiki/bin/create/Main/WebHome?parent=&templateprovider=XWiki.<username>&name=foo&spaceReference=Bar
, whereis the URL of your XWiki installation and is the username of the attacker.