Headline
CVE-2023-46732: RXSS through revision parameter in content menu
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit 04e325d57 can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
Log inSkip to main contentSkip to sidebar
Dashboards
Projects
Issues
Give feedback to Atlassian
Help
- Jira Core help
- Keyboard Shortcuts
- About Jira
- Jira Credits
Log In
- XWiki Platform
- XWIKI-21095
XMLWordPrintable
Details
**Type: ** Bug
Resolution: Fixed
**Priority: ** Blocker
- Affects Version/s: 9.7-rc-1
Documentation in Release Notes:
N/A
Description
Steps to reproduce:
Open <xwiki-host>/xwiki/bin/view/Main/?rev=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F15.5%25%25%22%3e%3cscript%3ealert(1)%3c%2fscript%3e where <xwiki-host> is the URL of your XWiki installation.
Expected result:
No alert is displayed.
Actual result:
An alert with content 1 is displayed.
This is due to the revision parameter being unescaped in the source viewer menu item, introduced as part of XWIKI-14576.
Attachments
Issue Links
is caused by
XWIKI-14576 Show version information and more actions options when viewing a document version
- Closed
links to
Activity
People
Votes:
0 Vote for this issue
Watchers:
1 Start watching this issue
Dates
Created:
02/Jul/23 08:59
Updated:
3 days ago 14:48
Resolved:
10/Jul/23 13:44
Related news
### Impact XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. The vulnerability can be demonstrated by opening `<xwiki-host>/xwiki/bin/view/Main/?rev=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F15.5%25%25%22%3e%3cscript%3ealert(1)%3c%2fscript%3e` where `<xwiki-host>` is the URL of your XWiki installation. If an alert is displayed, the installation is vulnerable. ### Patches This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. ### Workarounds The [patch](https://github.com/xwiki/xwiki-platform/commit/04e325d57d4bcb6ab7...