Headline
CVE-2022-29258: [XWIKI-19293] XSS in Filter Stream Converter Application
XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page Filter.FilterStreamDescriptorForm (with wiki editor) according to the instructions in the GitHub Security Advisory.
Details
Type: Bug
Status: Closed
Priority: Major
Resolution: Fixed
Affects Version/s: 6.0-milestone-2, 5.4.4
Fix Version/s: 12.10.11, 13.4.7, 14.0-rc-1, 13.10.3
Component/s: Filter - UI
Labels:
- security
- xss
Difficulty:
Unknown
Documentation:
N/A
Documentation in Release Notes:
N/A
Similar issues:
Description
The request parameters are not escaped before being put as default value in the form.
Attachments
Issue Links
links to
GitHub Security advisory
Activity
People
Assignee:
Thomas Mortagne
Reporter:
Thomas Mortagne
Votes:
0 Vote for this issue
Watchers:
1 Start watching this issue
Dates
Created:
04/Jan/22 11:19
Updated:
10 hours ago
Resolved:
04/Jan/22 11:48
Related news
### Impact We found a possible XSS vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. ### Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. ### Workarounds The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) and change the lines ``` <input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$request.get($descriptorId)#else$descriptor.defaultValue#end"/> #else <input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$request.get($descriptorId)"#end/> ``` into ``` <input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$escapetool.xml($request.get($descriptorId))#else$descriptor.defaultValue#end"/> #else <input type="text" id="$descrip...