Critical · published November 20, 2023
🚨 A single crafted image can be a gateway to stealing login cookies in XWiki! 😱 Think of XWiki like a restaurant where every image served is accompanied by your personal order details. If someone slips in a fake dish, they might see all your private notes about the food you love — and even worse, they can impersonate you to get more! This vulnerability is absolutely devastating: an attacker can impersonate any user viewing a diff and steal their session cookies. Not only does that grant access to protected content, but it also sets the stage for a potential server-side request forgery, letting attackers manipulate server requests under the guise of a legitimate user. Users' sensitive information is at risk, and the consequences could be catastrophic!
Think of XWiki like a restaurant where every image served is accompanied by your personal order details. If someone slips in a fake dish, they might see all your private notes about the food you love — and even worse, they can impersonate you to get more! This XSS vulnerability in XWiki allows unauthorized access to user session cookies when images from external domains are rendered in diffs. The server sends cookies with these requests, enabling attackers to impersonate users and cache sensitive content that can be accessed by others.
This vulnerability is absolutely devastating: an attacker can impersonate any user viewing a diff and steal their session cookies. Not only does that grant access to protected content, but it also sets the stage for a potential server-side request forgery, letting attackers manipulate server requests under the guise of a legitimate user. Users' sensitive information is at risk, and the consequences could be catastrophic! Immediate patches are available in XWiki versions 14.10.15, 15.5.1, and 15.6. If upgrading is not feasible, you can disable the image embedding feature by deleting `xwiki-platform-diff-xml-<version>.jar` from `WEB-INF/lib/`. Don't delay — secure your instance! You've got this! By following these steps, you'll ensure your XWiki is safe and sound. 🛡️