Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-xwph-x6xj-wggv: org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability

Impact

It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com.

Patches

The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Workarounds

The only way to workaround the bug is by providing a patched jar of xwiki-platform-oldcore containing the following changes: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf.

References

  • Jira ticket of the reported vulnerability: https://jira.xwiki.org/browse/XWIKI-19994
  • Jira ticket of the original mechanism put in place to prevent open redirect: https://jira.xwiki.org/browse/XWIKI-10309
  • Original advisory about open redirect: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv

For more information

If you have any questions or comments about this advisory:

ghsa
#vulnerability#git#java#jira#maven

Package

maven org.xwiki.platform:xwiki-platform-oldcore (Maven)

Affected versions

>= 6.0-rc-1, < 13.10.10

>= 14.0-rc-1, < 14.4.4

>= 14.5, < 14.8-rc-1

Patched versions

13.10.10

14.4.4

14.8-rc-1

Description

Impact

It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com.

Patches

The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Workarounds

The only way to workaround the bug is by providing a patched jar of xwiki-platform-oldcore containing the following changes: xwiki/xwiki-platform@e4f7f68#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf.

References

  • Jira ticket of the reported vulnerability: https://jira.xwiki.org/browse/XWIKI-19994
  • Jira ticket of the original mechanism put in place to prevent open redirect: https://jira.xwiki.org/browse/XWIKI-10309
  • Original advisory about open redirect: GHSA-jp55-vvmf-63mv

For more information

If you have any questions or comments about this advisory:

  • Open an issue in Jira
  • Email us at Security ML

References

  • GHSA-jp55-vvmf-63mv
  • GHSA-xwph-x6xj-wggv
  • xwiki/xwiki-platform@e4f7f68#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf
  • https://jira.xwiki.org/browse/XWIKI-10309
  • https://jira.xwiki.org/browse/XWIKI-19994

tmortagne published to xwiki/xwiki-platform

Apr 12, 2023

Published to the GitHub Advisory Database

Apr 12, 2023

Reviewed

Apr 12, 2023

Related news

CVE-2023-29204: XWIKI-19994: False positive redirect checking · xwiki/xwiki-platform@e4f7f68

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.