-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue within the XWiki platform. The root cause lies in the improper handling of the xredirect URL parameter when generating a deletion confirmation dialog. The commit cb578b1b2910d06e9dd7581077072d1cfbd280f2 reveals that the vulnerability exists in a Velocity template macro named xwikimessagebox, which is defined in two separate files for different skins/themes.
The vulnerable code constructed a button with an onclick javascript event handler. The value of the $urlno parameter, derived from the user-controllable xredirect parameter, was directly embedded within single quotes inside the onclick attribute. This allowed an attacker to break out of the string and inject arbitrary Javascript. For example, a crafted xredirect parameter like ';alert('XSS');// would result in the execution of the script when the "No" button on the confirmation page was clicked.
The patch remediates this by removing the input button and the associated onclick event handler entirely. It replaces them with standard <a> tags, where the $urlno is used in the href attribute. This change prevents the direct execution of Javascript from the onclick attribute, mitigating the XSS vulnerability.
The identified vulnerable "function" is the xwikimessagebox macro, as it's the specific piece of code responsible for the insecure construction of the UI component. While not a traditional compiled function, it is the runtime component that processes the malicious input and creates the vulnerable output.
xwikimessageboxxwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/macros.vm
xwikimessageboxxwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-flamingo-skin-resources | maven | >= 6.2-milestone-1, < 16.10.10 | 16.10.10 |
| org.xwiki.platform:xwiki-platform-flamingo-skin-resources | maven | >= 17.0.0-rc-1, < 17.4.2 | 17.4.2 |
| org.xwiki.platform:xwiki-platform-web-templates | maven | >= 6.2-milestone-1, < 16.10.10 | 16.10.10 |
| org.xwiki.platform:xwiki-platform-web-templates | maven | >= 17.0.0-rc-1, < 17.4.2 | 17.4.2 |