Listen to this Post
How the CVE Works
The vulnerability stems from XWiki’s XHTML syntax relying on xdom+xml/current, which permits raw HTML blocks containing JavaScript. Attackers exploit this by setting a document’s syntax to `xdom+xml/current` and injecting malicious scripts via crafted metadata entries. For example:
<document> <metadata><entry><string>syntax</string> <org.xwiki.rendering.syntax.Syntax> <type><name>XHTML</name><id>xhtml</id></type> <version>5</version> </org.xwiki.rendering.syntax.Syntax></entry></metadata> <rawtext syntax="html/5.0" content="<script>alert(1);</script>"></rawtext> </document>
This bypasses sanitization, enabling XSS when users edit documents (e.g., profiles). The fix removes `xdom+xml/current` dependency in XHTML syntax.
DailyCVE Form
Platform: XWiki
Version: <14.10
Vulnerability: XSS via XHTML
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch expected in 14.10 (2023-Q4)
What Undercode Say
Analytics:
curl -XGET 'wiki/_analyze?q=xdom+xml' grep -r "xdom+xml/current" /xwiki/config
Exploit:
<rawtext syntax="html/5.0" content="<script>exfiltrate()</script>">
Protection:
- Upgrade to XWiki ≥14.10
- Disable `xdom+xml` syntax
Impact:
- Arbitrary JS execution
- Session hijacking
- Data theft
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
