Cross-Site Scripting (XSS) Affecting org.xwiki.platform:xwiki-platform-web-templates package, versions [,14.10.12)[15.0-rc-1,15.5-rc1)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.28% (68th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-Site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGXWIKIPLATFORM-6036197
  • published26 Oct 2023
  • disclosed25 Oct 2023
  • creditUnknown

Introduced: 25 Oct 2023

CVE-2023-45134  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade org.xwiki.platform:xwiki-platform-web-templates to version 14.10.12, 15.5-rc1 or higher.

Overview

org.xwiki.platform:xwiki-platform-web-templates is a Web Resources for the XWiki platform.

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS). An attacker can create a template provider containing malicious code on any document that is part of the wiki. This code is executed when a user selects this template provider during document creation. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.

PoC

  1. As a simple user with no script right, edit the user profile with the object editor and add an object of type "Template Provider Class". Set the name to "My Template", set template to any page on the wiki. In "Creation Restrictions", enter <img onerror="alert(1)" src="https://www.example.com". Accept the suggestion to add this string in the dropdown. Click "Save & View"

  2. As any user with edit right, open <xwiki-host>/xwiki/bin/create/Main/WebHome?parent=&templateprovider=XWiki.<username>&name=foo&spaceReference=Bar, where is the URL of your XWiki installation and is the username of the attacker.

CVSS Scores

version 3.1