Critical · published April 20, 2023
🚨 A misbehaving HTML cleaner has opened Pandora's box! The "restricted" mode in XWiki Commons lets attackers inject arbitrary JavaScript through sneaky invalid comments — yikes! 🔥 It's like a restaurant serving a special 'safe' dish, but the chef forgets to check the ingredients, leading to someone sneaking in a dangerous allergen — in this case, malicious code. 🥴 If a privileged user with programming rights encounters one of these tainted comments, the malicious JavaScript executes within their session. This could lead to server-side code execution, putting the confidentiality, integrity, and availability of your entire XWiki instance at risk — absolutely devastating!
It's like a restaurant serving a special 'safe' dish, but the chef forgets to check the ingredients, leading to someone sneaking in a dangerous allergen — in this case, malicious code. 🥴 This vulnerability allows cross-site scripting (XSS) through the injection of arbitrary HTML code via invalid comments in the restricted mode of the HTML cleaner. When a privileged user views such comments, the attacker’s JavaScript runs in their context, granting undue access.
If a privileged user with programming rights encounters one of these tainted comments, the malicious JavaScript executes within their session. This could lead to server-side code execution, putting the confidentiality, integrity, and availability of your entire XWiki instance at risk — absolutely devastating! Upgrade to XWiki version 14.10 immediately, where HTML comments are purged in restricted mode and a crucial check prevents injections. Ensure that your team is aware as there are no viable workarounds! You've got this! Stay vigilant and secure your XWiki environment today! 🛡️