CVE-2022-29251: Cross-site Scripting in the Flamingo theme manager
Summary
CVE-2022-29251: Cross-site Scripting in the Flamingo theme manager. Affects org.xwiki.platform:xwiki-platform-flamingo-theme-ui across 3 version ranges.
< 12.10.11
>= 13.0.0, < 13.4.7
>= 13.5.0, < 13.10.3
Fixed in 12.10.11, 13.4.7 or 13.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Flamingo theme manager is a component of the XWiki platform that allows users to manage and customize the themes used in their XWiki instances. It provides a user-friendly interface for selecting and applying themes. The FlamingoThemesCode.WebHomeSheet wiki page is responsible for handling theme-related operations. However, a vulnerability has been discovered in this page that allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability exists in the FlamingoThemesCode.WebHomeSheet wiki page, specifically in the "newThemeName" form field. Attackers can exploit this vulnerability by injecting malicious scripts into the form field, which will then be executed when the page is rendered for other users. This can lead to various consequences, including the theft of sensitive information, session hijacking, or the manipulation of page content. The issue has been assigned a CVSS score of 7.4, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.1112.10.11 -
>= 13.0.0, < 13.4.713.4.7 -
>= 13.5.0, < 13.10.313.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the patched versions is not immediately feasible, a temporary workaround can be implemented by manually editing the FlamingoThemesCode.WebHomeSheet wiki page. Locate the line <input type="hidden" name="newThemeName" id="newThemeName" value="$request.newThemeName" /> and replace it with <input type="hidden" name="newThemeName" id="newThemeName" value="$escapetool.xml($request.newThemeName)" />. This modification will ensure that the user input is properly escaped, preventing the XSS vulnerability.
Conclusion
In conclusion, the Flamingo theme manager in the XWiki platform is vulnerable to cross-site scripting (XSS) attacks. It is crucial to update to the patched versions or apply the provided workaround to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui →
FAQ
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to the theft of sensitive information, session hijacking, or the manipulation of page content.
To fix this vulnerability, update to the patched versions of the Flamingo theme manager (12.10.11, 14.0-rc-1, 13.4.7, or 13.10.3). Alternatively, apply the provided workaround by manually editing the FlamingoThemesCode.WebHomeSheet wiki page.
There are no known public exploits of this vulnerability at the time of this advisory. However, it is important to promptly apply the necessary patches or workarounds to mitigate the risk.
Yes, this vulnerability can be exploited remotely. Attackers can inject malicious scripts into the newThemeName form field, which will then be executed when the page is rendered for other users.
For more information, you can refer to the XWiki Jira issue https://jira.xwiki.org/browse/XWIKI-19294 and the corresponding commit in the XWiki GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui.
