9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-29202

CVE-2023-29202: org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability

Impact

The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter content was set to true. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki.

The issue can be reproduced by inserting the following XWiki syntax in any wiki page like the user account:

{{rss feed="https://xssrss.blogspot.com/feeds/posts/default?alt=rss" content="true" /}}

If an alert is displayed when viewing the page, the wiki is vulnerable.

Patches

The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed.

Workarounds

If the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar, where XX is XWiki's version, in the web application's directory.

References

https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03
https://jira.xwiki.org/browse/XWIKI-19671

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-29202

CVE-2023-29202:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-core-rendering-macro-rss	maven	>= 1.8, <= 3.0.1
org.xwiki.platform:xwiki-platform-rendering-macro-rss	maven	< 14.6-rc-1	14.6-rc-1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from how feed content was handled in generateEntries(). Pre-patch code created a RawBlock with SyndEntry's description value using Syntax.XHTML_1_0 without sanitization (visible in the diff where 'cleanHTML()' was added post-patch). This direct injection of unprocessed user-controlled HTML input enabled XSS. The commit introduced HTMLCleaner usage to sanitize content, confirming the vulnerable flow was in this method.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-29202: org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability

Impact

Patches

Workarounds

References

For more information

CVE-2023-29202:

9.1

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

9.1

9.1

Basic Information

Basic Information

CVE-2023-29202: org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability

Impact

Patches

Workarounds

References

For more information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI