Critical · published October 25, 2023
🚨 A crafty user account can turn into a malicious template factory! XWiki's design allows users to create templates that could unleash harmful scripts on the platform, potentially leading to some drastic consequences. 🔥 This is like a restaurant where anyone with a reservation can slip a secret ingredient into the chef's special, which gets served to every guest who orders it. If the chef doesn't check the recipe, the whole dining experience can be spoiled! If an attacker exploits this XSS vulnerability, they can run arbitrary code with the privileges of the user who clicks the malicious link. This could mean full access to sensitive data or even complete control over the XWiki installation, which is absolutely devastating for any organization relying on it.
This is like a restaurant where anyone with a reservation can slip a secret ingredient into the chef's special, which gets served to every guest who orders it. If the chef doesn't check the recipe, the whole dining experience can be spoiled! Versions of XWiki from 3.1-milestone-1 to 13.4-rc-1, and specific web templates, are vulnerable due to a lack of proper escaping that allows an attacker to inject malicious code into a template provider, which is then executed upon document creation.
If an attacker exploits this XSS vulnerability, they can run arbitrary code with the privileges of the user who clicks the malicious link. This could mean full access to sensitive data or even complete control over the XWiki installation, which is absolutely devastating for any organization relying on it. Update XWiki to versions 13.4-rc-1, 14.10.2, or 15.5-rc-1 for the affected components to secure your installation. If updating isn’t possible immediately, manually patch the vulnerable `createinline.vm` file to prevent exploitation. Don't wait! You've got this! Patch your systems and keep your XWiki safe from nasty surprises. 🛡️