CVE-2023-29528 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Attackers can inject malicious JavaScript via invalid HTML comments in restricted mode, leading to server-side code execution when privileged users view the content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29528?
CVE-2023-29528 is a critical cross-site scripting vulnerability in xwiki-commons, published on 20 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.
Weakness: CWE-79
Which versions are affected by CVE-2023-29528?
2 open source packages ship an affected version, including org.xwiki.commons:xwiki-commons-xml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.commons:xwiki-commons-xml Maven | From 4.2-milestone-1 | 14.10 |
org.xwiki.commons:xwiki-commons-xml Maven | From 4.2-milestone-1 | 14.10 |
Products include Xwiki Commons.
How do I fix CVE-2023-29528?
Upgrade org.xwiki.commons:xwiki-commons-xml to 14.10 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29528 being exploited?
There is no known exploitation of CVE-2023-29528 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in xwiki-commons
- CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name
- CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml
- CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
Sources
Also known as GHSA-x37v-36wv-6v6h.