GitStock

xwiki/xwiki-platform · Security

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

GHSA ID
GHSA-9r9j-57rf-f6vj
CVE ID
CVE-2022-36097
Severity
high
Published
Updated
CVSS
8.9 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v3
8.9 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Description

Impact

It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment.

For example, an attachment with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.

Patches

This issue has been patched in XWiki 14.4RC1.

Workarounds

It is possible to fix the vulnerability by copying moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace

#set($titleToDisplay = $services.localization.render('attachment.move.title', 
  [$attachment.name, $escapetool.xml($doc.plainTitle), $doc.getURL()]))

by

#set($titleToDisplay = $services.localization.render('attachment.move.title', [
  $escapetool.xml($attachment.name), 
  $escapetool.xml($doc.plainTitle), 
  $escapetool.xml($doc.getURL())
]))

See the corresponding patch.

References

For more information

If you have any questions or comments about this advisory:

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

References

Open GitHub