From 0a2a21632f4f5d80d40760e9980cef96621e9ad5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 27 Oct 2023 21:01:50 +0000 Subject: [PATCH] Publish Advisories GHSA-93gh-jgjj-r929 GHSA-ghf6-2f42-mjh9 GHSA-gr82-8fj2-ggc3 GHSA-qcj9-gcpg-4w2w --- .../2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json | 6 +++--- .../2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json | 6 +++--- .../2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json | 6 +++--- .../2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) rename advisories/{unreviewed => github-reviewed}/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json (94%) rename advisories/{unreviewed => github-reviewed}/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json (94%) rename advisories/{unreviewed => github-reviewed}/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json (70%) rename advisories/{unreviewed => github-reviewed}/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json (92%) diff --git a/advisories/unreviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json b/advisories/github-reviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json similarity index 94% rename from advisories/unreviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json rename to advisories/github-reviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json index de1a9952a5e..ad0f33d51e5 100644 --- a/advisories/unreviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json +++ b/advisories/github-reviewed/2023/10/GHSA-93gh-jgjj-r929/GHSA-93gh-jgjj-r929.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-93gh-jgjj-r929", - "modified": "2023-10-25T21:30:33Z", + "modified": "2023-10-27T21:01:16Z", "published": "2023-10-25T21:14:07Z", "aliases": [ "CVE-2023-45137" ], "summary": "XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages", - "details": "### Impact\nWhen trying to create a document that already exists, XWiki displays an error message in the form for creating it. Due to missing escaping, this error message is vulnerable to raw HTML injection and thus XSS. The injected code is the document reference of the existing document so this requires that the attacker first creates a non-empty document whose name contains the attack code. \n\nTo reproduce, the following steps can be used:\n\n1. Go to `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=&spaceReference=&name=%3Cimg%20onerror=%22alert(1)%22%20src=%22test%22` where `` is the URL of your XWiki installation.\n2. Create the page and add some content.\n3. Go again to `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=&spaceReference=&name=%3Cimg%20onerror=%22alert(1)%22%20src=%22test%22` where `` is the URL of your XWiki installation.\n\nIf an alert with content \"1\" is displayed, the installation is vulnerable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding the appropriate escaping.\n\n### Workarounds\nThe vulnerable template file createinline.vm is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ed8ec747967f8a16434806e727a57214a8843581#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/ed8ec747967f8a16434806e727a57214a8843581\n* https://jira.xwiki.org/browse/XWIKI-20961\n", + "details": "### Impact\nWhen trying to create a document that already exists, XWiki displays an error message in the form for creating it. Due to missing escaping, this error message is vulnerable to raw HTML injection and thus XSS. The injected code is the document reference of the existing document so this requires that the attacker first creates a non-empty document whose name contains the attack code. \n\nTo reproduce, the following steps can be used:\n\n1. Go to `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=&spaceReference=&name=%3Cimg%20onerror=%22alert(1)%22%20src=%22test%22` where `` is the URL of your XWiki installation.\n2. Create the page and add some content.\n3. Go again to `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=&spaceReference=&name=%3Cimg%20onerror=%22alert(1)%22%20src=%22test%22` where `` is the URL of your XWiki installation.\n\nIf an alert with content \"1\" is displayed, the installation is vulnerable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding the appropriate escaping.\n\n### Workarounds\nThe vulnerable template file createinline.vm is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ed8ec747967f8a16434806e727a57214a8843581#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).", "severity": [ { "type": "CVSS_V3", @@ -100,7 +100,7 @@ "CWE-79" ], "severity": "CRITICAL", - "github_reviewed": false, + "github_reviewed": true, "github_reviewed_at": "2023-10-25T21:14:07Z", "nvd_published_at": null } diff --git a/advisories/unreviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json b/advisories/github-reviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json similarity index 94% rename from advisories/unreviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json rename to advisories/github-reviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json index cf044dc8202..b9c5e895b7b 100644 --- a/advisories/unreviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json +++ b/advisories/github-reviewed/2023/10/GHSA-ghf6-2f42-mjh9/GHSA-ghf6-2f42-mjh9.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-ghf6-2f42-mjh9", - "modified": "2023-10-25T21:30:32Z", + "modified": "2023-10-27T21:01:12Z", "published": "2023-10-25T21:13:10Z", "aliases": [ "CVE-2023-45135" ], "summary": "XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title", - "details": "### Impact\nIn XWiki, it is possible to pass a title to the page creation action that isn't displayed at first but then executed in the second step. This can be used by an attacker to trick a victim to execute code, allowing script execution if the victim has script right or remote code execution including full access to the XWiki instance if the victim has programming right.\n\nFor the attack to work, the attacker needs to convince the victim to visit a link like `/xwiki/bin/create/NonExistingSpace/WebHome?title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22)` where `` is the URL of the Wiki installation and to then click on the \"Create\" button on that page. The page looks like a regular XWiki page that the victim would also see when clicking the button to create a page that doesn't exist yet, the malicious code is not displayed anywhere on that page. After clicking the \"Create\" button, the malicious title would be displayed but at this point, the code has already been executed and the attacker could use this code also to hide the attack, e.g., by redirecting the victim again to the same page with an innocent title. It thus seems plausible that this attack could work if the attacker can place a fake \"create page\" button on a page which is possible with edit right.\n\n### Patches\nThis has been patched in XWiki 14.10.2 and 15.5RC1 by displaying the title already in the first step such that the victim can notice the attack before continuing.\n\n### Workarounds\nIt is possible to manually patch the modified files from the [patch](https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b) in an existing installation. For the JavaScript change, the minified JavaScript file would need to be obtained from a build of XWiki and replaced accordingly. \n\n### References\n* https://jira.xwiki.org/browse/XWIKI-20869\n* https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b", + "details": "### Impact\nIn XWiki, it is possible to pass a title to the page creation action that isn't displayed at first but then executed in the second step. This can be used by an attacker to trick a victim to execute code, allowing script execution if the victim has script right or remote code execution including full access to the XWiki instance if the victim has programming right.\n\nFor the attack to work, the attacker needs to convince the victim to visit a link like `/xwiki/bin/create/NonExistingSpace/WebHome?title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22)` where `` is the URL of the Wiki installation and to then click on the \"Create\" button on that page. The page looks like a regular XWiki page that the victim would also see when clicking the button to create a page that doesn't exist yet, the malicious code is not displayed anywhere on that page. After clicking the \"Create\" button, the malicious title would be displayed but at this point, the code has already been executed and the attacker could use this code also to hide the attack, e.g., by redirecting the victim again to the same page with an innocent title. It thus seems plausible that this attack could work if the attacker can place a fake \"create page\" button on a page which is possible with edit right.\n\n### Patches\nThis has been patched in XWiki 14.10.2 and 15.5RC1 by displaying the title already in the first step such that the victim can notice the attack before continuing.\n\n### Workarounds\nIt is possible to manually patch the modified files from the [patch](https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b) in an existing installation. For the JavaScript change, the minified JavaScript file would need to be obtained from a build of XWiki and replaced accordingly. ", "severity": [ { "type": "CVSS_V3", @@ -100,7 +100,7 @@ "CWE-116" ], "severity": "CRITICAL", - "github_reviewed": false, + "github_reviewed": true, "github_reviewed_at": "2023-10-25T21:13:10Z", "nvd_published_at": null } diff --git a/advisories/unreviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json b/advisories/github-reviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json similarity index 70% rename from advisories/unreviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json rename to advisories/github-reviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json index 4cc9d18a34b..269681e91d9 100644 --- a/advisories/unreviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json +++ b/advisories/github-reviewed/2023/10/GHSA-gr82-8fj2-ggc3/GHSA-gr82-8fj2-ggc3.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-gr82-8fj2-ggc3", - "modified": "2023-10-25T21:30:32Z", + "modified": "2023-10-27T21:00:37Z", "published": "2023-10-25T21:09:06Z", "aliases": [ "CVE-2023-45134" ], "summary": "XWiki Platform XSS vulnerability from account in the create page form via template provider", - "details": "### Impact\nAn attacker can create a template provider on any document that is part of the wiki (could be the attacker's user profile) that contains malicious code. This code is executed when this template provider is selected during document creation which can be triggered by sending the user to a URL. For the attacker, the only requirement is to have an account as by default the own user profile is editable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\nFor reproduction, the following steps can be used:\n\n1. As a simple user with no script right, edit the user profile with the object editor and add an object of type \"Template Provider Class\". Set the name to \"My Template\", set template to any page on the wiki. In \"Creation Restrictions\", enter `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=XWiki.&name=foo&spaceReference=Bar`, where `` is the URL of your XWiki installation and `` is the username of the attacker.\n\nIf an alert is displayed, the installation is vulnerable.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding the appropriate escaping.\n\n### Workarounds\nThe vulnerable template file createinline.vm is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e\n* https://jira.xwiki.org/browse/XWIKI-20962", + "details": "### Impact\nAn attacker can create a template provider on any document that is part of the wiki (could be the attacker's user profile) that contains malicious code. This code is executed when this template provider is selected during document creation which can be triggered by sending the user to a URL. For the attacker, the only requirement is to have an account as by default the own user profile is editable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\nFor reproduction, the following steps can be used:\n1. As a simple user with no script right, edit the user profile with the object editor and add an object of type \"Template Provider Class\". Set the name to \"My Template\", set template to any page on the wiki. In \"Creation Restrictions\", enter `/xwiki/bin/create/Main/WebHome?parent=&templateprovider=XWiki.&name=foo&spaceReference=Bar`, where `` is the URL of your XWiki installation and `` is the username of the attacker.\n\nIf an alert is displayed, the installation is vulnerable.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding the appropriate escaping.\n\n### Workarounds\nThe vulnerable template file createinline.vm is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e\n* https://jira.xwiki.org/browse/XWIKI-20962", "severity": [ { "type": "CVSS_V3", @@ -119,7 +119,7 @@ "CWE-79" ], "severity": "CRITICAL", - "github_reviewed": false, + "github_reviewed": true, "github_reviewed_at": "2023-10-25T21:09:06Z", "nvd_published_at": null } diff --git a/advisories/unreviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json b/advisories/github-reviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json similarity index 92% rename from advisories/unreviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json rename to advisories/github-reviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json index 93cc784c56a..f9e85ff4636 100644 --- a/advisories/unreviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json +++ b/advisories/github-reviewed/2023/10/GHSA-qcj9-gcpg-4w2w/GHSA-qcj9-gcpg-4w2w.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-qcj9-gcpg-4w2w", - "modified": "2023-10-25T21:30:32Z", + "modified": "2023-10-27T21:01:13Z", "published": "2023-10-25T21:13:37Z", "aliases": [ "CVE-2023-45136" ], "summary": "XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled", - "details": "### Impact\nWhen document names are validated according to a name strategy (disabled by default), XWiki is vulnerable to a reflected XSS attack in the page creation form. To reproduce, make sure that \"Validate names before saving\" is enabled in the administration under \"Editing\" -> \"Name strategies\" and then open `/xwiki/bin/create/Main/%3Cscript%3Ealert%28%27Test%20Test%20Test%20Test%20Test%27%29%3C%2Fscript%3E` where `` is the URL of your XWiki installation. This displays an alert if the installation is vulnerable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding appropriate escaping.\n\n### Workarounds\nThe vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).\n\n### References\n\n* https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e\n* https://jira.xwiki.org/browse/XWIKI-20854", + "details": "### Impact\nWhen document names are validated according to a name strategy (disabled by default), XWiki is vulnerable to a reflected XSS attack in the page creation form. To reproduce, make sure that \"Validate names before saving\" is enabled in the administration under \"Editing\" -> \"Name strategies\" and then open `/xwiki/bin/create/Main/%3Cscript%3Ealert%28%27Test%20Test%20Test%20Test%20Test%27%29%3C%2Fscript%3E` where `` is the URL of your XWiki installation. This displays an alert if the installation is vulnerable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.12 and 15.5RC1 by adding appropriate escaping.\n\n### Workarounds\nThe vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the [changes from the fix](https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e#diff-c222148bddebe4ff7629350f4053b618504a4ab172e697938c8fddf7c1fc6bc8).", "severity": [ { "type": "CVSS_V3", @@ -81,7 +81,7 @@ "CWE-79" ], "severity": "CRITICAL", - "github_reviewed": false, + "github_reviewed": true, "github_reviewed_at": "2023-10-25T21:13:37Z", "nvd_published_at": null }