CVE-2021-43841: Cross-site Scripting by SVG upload in xwiki-platform
Summary
CVE-2021-43841: Cross-site Scripting by SVG upload in xwiki-platform. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 12.10.6
>= 13.0, < 13.3RC1
Fixed in 12.10.6 or 13.3RC1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xwiki-platform-oldcore package is an open-source platform for developing collaborative applications. It provides a framework for creating and managing content, including attachments. The package is written in Java and is commonly used for building wikis, knowledge bases, and other collaborative platforms. However, a vulnerability has been discovered in the package that allows an attacker to upload an SVG file containing malicious scripts.
Vulnerability Detail
The vulnerability in xwiki-platform-oldcore allows an attacker to upload an SVG file with embedded scripts. When the file is downloaded, the script is executed, leading to a cross-site scripting (XSS) attack. By exploiting this vulnerability, an attacker can inject arbitrary code into the victim's browser, potentially compromising user data or performing unauthorized actions on behalf of the user. The default configuration of XWiki allows the display of SVG files in the browser, making it easier for an attacker to exploit this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.612.10.6 -
>= 13.0, < 13.3RC113.3RC1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by properly configuring the XWiki instance to download or display files. The XWiki documentation provides guidance on how to set up the configuration to prevent the display of SVG files in the browser. By following the recommended configuration, the risk of XSS attacks through SVG uploads can be mitigated.
Conclusion
The xwiki-platform-oldcore package is vulnerable to a cross-site scripting (XSS) attack through SVG file uploads. To mitigate this vulnerability, it is recommended to update the package to version 12.10.6 or later, which includes a patch that prevents the display of SVG files in the browser. Alternatively, the XWiki instance can be configured to disable the display of SVG files. Regularly updating the package and following security best practices will help protect against this and other vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to unauthorized actions or data compromise.
Updating the xwiki-platform-oldcore package to version 12.10.6 or later includes a patch that mitigates the vulnerability. Alternatively, configuring the XWiki instance to prevent the display of SVG files can also mitigate the risk.
No, versions 0 to 12.10.6 are affected. Versions 13.0 to 13.2 are also affected, but the vulnerability has been fixed in version 13.3RC1.
Yes, this vulnerability can be exploited remotely by uploading a malicious SVG file to the vulnerable XWiki instance.
There is no known public exploit of this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
