CVE-2023-29206: org.xwiki.platform:xwiki-platform-skin-skinx - Cross-site Scripting Vulnerability
Summary
CVE-2023-29206: Impact There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script... Affects org.xwiki.platform:xwiki-platform-skin-skinx versions >= 3.0-milestone-1, < 14.9-rc-1. Fixed in 14.9-rc-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-skin-skinx package is a component of the XWiki platform, which is an open-source wiki software written in Java. It provides a skinning mechanism for customizing the appearance of XWiki applications. The skinx skinning module allows users to create and apply custom skins to their XWiki instances. However, a vulnerability has been discovered in the skinx module that could lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-skin-skinx arises from a lack of proper authorization checks when adding JavaScript or StyleSheet xobjects to XWiki documents. This allows an attacker with only Edit rights to create malicious scripts that can be executed by users with appropriate privileges. By exploiting this vulnerability, an attacker can perform unauthorized operations on the affected XWiki instance. The vulnerability has a CVSS score of 9.0, indicating a critical severity level.
How To Fix
Minimum fixed version
14.9-rc-1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is available. It involves applying the patch provided in the following GitHub commit: GitHub Commit. After applying the patch, the xwiki-platform-skin-skinx package needs to be rebuilt and redeployed.
Conclusion
The org.xwiki.platform:xwiki-platform-skin-skinx package is vulnerable to a critical cross-site scripting (XSS) vulnerability. To protect your XWiki instance, it is crucial to upgrade to version 14.9-rc-1 or later, which includes the necessary patch. If immediate upgrade is not possible, applying the provided patch and rebuilding the xwiki-platform-skin-skinx package can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-skin-skinx →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts on an XWiki instance, potentially leading to unauthorized operations and data manipulation.
Any XWiki instance that is using the org.xwiki.platform:xwiki-platform-skin-skinx package version 3.0-milestone-1 or earlier is affected by this vulnerability.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is advisable to apply the recommended patches or workarounds as soon as possible.
Yes, this vulnerability can be exploited remotely by an attacker with Edit rights on the targeted XWiki instance.
No, upgrading to the patched version or applying the provided patch is the recommended solution to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-skin-skinx.
