CVE-2022-29252: Cross-site Scripting in wiki manager join wiki page
Summary
CVE-2022-29252: Cross-site Scripting in wiki manager join wiki page. Affects org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki across 3 version ranges.
< 12.10.11
>= 13.0.0, < 13.4.7
>= 13.5.0, < 13.10.3
Fixed in 12.10.11, 13.4.7 or 13.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package affected by this vulnerability is org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki. It is a Maven package that is part of the XWiki Platform, an open-source wiki software written in Java. The package provides the user interface for managing wikis in XWiki. It allows users to create, join, and manage wikis, as well as perform various wiki-related actions. The vulnerability affects the 'WikiManager.JoinWiki' wiki page, specifically the 'requestJoin' field.
Vulnerability Detail
The vulnerability is a cross-site scripting (XSS) issue. It occurs due to improper input sanitization in the 'WikiManager.JoinWiki' page. An attacker can exploit this vulnerability by injecting malicious scripts or HTML code into the 'requestJoin' field, which is not properly escaped or sanitized. When a user views the affected page, the injected code will be executed in their browser, potentially leading to unauthorized actions, data theft, or other malicious activities. The impact of this vulnerability is considered high, with a CVSS score of 7.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.1112.10.11 -
>= 13.0.0, < 13.4.713.4.7 -
>= 13.5.0, < 13.10.313.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to a patched version is not immediately possible, a temporary workaround can be applied by manually editing the 'WikiManager.JoinWiki' wiki page. The line containing the 'requestJoin' field should be modified to include proper input sanitization. The original line:
<input type='hidden' name='requestJoin' value="$!request.requestJoin"/>
should be changed to:
<input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)">
This modification will ensure that the input is properly escaped and prevent the execution of injected code.
Conclusion
In conclusion, the org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki package is vulnerable to a cross-site scripting (XSS) issue in the 'WikiManager.JoinWiki' wiki page. The vulnerability can be mitigated by updating to the patched versions of the package or applying the provided workaround. It is important to take action to prevent the execution of malicious code and protect users from potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized actions, data theft, or other malicious activities.
The recommended fix is to update to one of the patched versions of the package: 12.10.11, 14.0-rc-1, 13.4.7, or 13.10.3. These versions include proper input sanitization to prevent the execution of malicious code.
Yes, a temporary workaround is to manually edit the 'WikiManager.JoinWiki' wiki page and modify the line containing the 'requestJoin' field to include proper input sanitization. Details of the required modification are provided in the 'workaround' section.
Yes, you can find more information about this vulnerability in the XWiki Jira issue XWIKI-19292 and the corresponding GitHub commit.
For further support or assistance regarding this vulnerability, you can open an issue in the XWiki Jira or contact the XWiki security mailing list at security@xwiki.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki.
