Critical · published April 15, 2023
🚨 An unguarded RSS feed could open the door to chaos! An attacker can inject JavaScript right into your wiki like a sneaky chef adding secret ingredients to a recipe without anyone noticing. 🔥 Think of your XWiki as a restaurant, where every dish served is a combination of user-generated content. If the chef doesn't check the ingredients of each dish before it hits the table, you might end up with a nasty surprise — like a dish spiked with something harmful instead of the delicious flavor it was meant to have! If exploited, this vulnerability could allow an attacker to execute arbitrary actions within your wiki, including privilege escalation and remote code execution. This could lead to sensitive information disclosure, modification or deletion of content, and even the complete sabotage of your entire wiki system. The consequences could be absolutely devastating for both users and administrators!
Think of your XWiki as a restaurant, where every dish served is a combination of user-generated content. If the chef doesn't check the ingredients of each dish before it hits the table, you might end up with a nasty surprise — like a dish spiked with something harmful instead of the delicious flavor it was meant to have! This XSS vulnerability occurs in the XWiki RSS macro when the `content` parameter is set to `true`, allowing malicious HTML and JavaScript to pass through without proper sanitization, creating a dangerous situation for any user with programming rights.
If exploited, this vulnerability could allow an attacker to execute arbitrary actions within your wiki, including privilege escalation and remote code execution. This could lead to sensitive information disclosure, modification or deletion of content, and even the complete sabotage of your entire wiki system. The consequences could be absolutely devastating for both users and administrators! To secure your XWiki, upgrade to version 14.6 RC1 immediately, where this issue has been patched. As a temporary workaround, uninstall the RSS macro by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar` from the web application's directory. Don't wait — lock it down now! You've got this! With these steps, you can secure your wiki and keep it safe from harm! 🛡️