CVE-2023-40176: XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer
Summary
CVE-2023-40176: XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer. Affects org.xwiki.platform:xwiki-platform-web-templates versions >= 4.1-milestone-2, < 14.10.5. Fixed in 14.10.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It provides a platform for creating and managing wikis, with features such as user profiles, content organization, and access control. The user profile functionality allows users to customize their preferences, including the time zone setting. However, a vulnerability in the user profile time zone displayer allows for stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the lack of proper input sanitization and output encoding in the time zone displayer of the user profile. An attacker can exploit this by setting a malicious payload as the value of the time zone user preference. When another user visits the attacker's profile, the payload gets executed, leading to potential information theft and even escalation of access rights. The vulnerability has been present since version 4.1M2 of XWiki Platform.
How To Fix
Minimum fixed version
14.10.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For older versions of XWiki that have not been patched, a workaround involves editing the 'displayer_timezone.vm' file and adding the escape function for the displayed time zone value. The following code snippet demonstrates the required change:
- $!value
+ $!escapetool.xml($value)
Conclusion
The XWiki Platform Stored Cross-site Scripting vulnerability in the user profile time zone displayer can be mitigated by applying the provided patch or workaround. It is recommended to update to the fixed versions of XWiki or manually apply the patch to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web-templates →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of another user visiting their profile. This can lead to information theft and potential escalation of access rights.
You can use Vulert's playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known instances of this vulnerability being exploited in the wild. However, it is recommended to apply the patch or workaround to mitigate the risk.
No, this vulnerability requires an authenticated user to set the malicious payload in their user profile. It cannot be exploited remotely without valid user credentials.
For more information, you can refer to the XWiki JIRA issue (https://jira.xwiki.org/browse/XWIKI-20276) and the fix commit (https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web-templates.
