Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-35159

CVE-2023-35159: XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

9.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-35159
GHSA ID
GHSA-x234-mg7q-m8g8
EPSS Score
0.86858%
CWE
CWE-79
Published
6/22/2023
Updated
11/12/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 3.4-milestone-1, < 14.10.514.10.5
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 15.0-rc-1, < 15.1-rc-115.1-rc-1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the deletespace.vm template directly using the xredirect parameter value in a URL context without proper sanitization. The commit diff shows the patched version replaces the unsafe assignment with #getSanitizedURLAttributeValue, a macro introduced to validate URLs. The unpatched code's line '#set ($cancelURL = $request.xredirect)' allowed arbitrary JavaScript execution when the parameter value started with 'javascript:'. This matches the XSS pattern described in CWE-79 and CWE-87.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Us*rs *r* **l* to *or** *n URL wit* * p*ylo** *llowin* to inj**t J*v*s*ript in t** p*** (XSS). It's possi*l* to *xploit t** **l*t*sp*** t*mpl*t* to p*r*orm * XSS, *.*. *y usin* URL su** *s: > xwiki/*in/**l*t*sp***/S*n**ox/?xr**ir**t=j*v*s

Reasoning

T** vuln*r**ility st*ms *rom t** **l*t*sp***.vm t*mpl*t* *ir**tly usin* t** xr**ir**t p*r*m*t*r v*lu* in * URL *ont*xt wit*out prop*r s*nitiz*tion. T** *ommit *i** s*ows t** p*t**** v*rsion r*pl***s t** uns*** *ssi*nm*nt wit* #**tS*nitiz**URL*ttri*ut