CVE-2023-35153 : Security Advisory and Response

This article provides detailed information about CVE-2023-35153, a vulnerability in XWiki Platform that allows stored cross-site scripting attacks through the

name

parameters in the ClassEditSheet page.

Understanding CVE-2023-35153

XWiki Platform is a generic wiki platform. The vulnerability exists in versions 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, allowing users with edit rights to execute malicious scripts by manipulating certain parameters.

What is CVE-2023-35153?

The CVE-2023-35153 vulnerability in XWiki Platform enables stored cross-site scripting attacks through the

name

parameters in the ClassEditSheet page. Attackers can exploit this issue to execute arbitrary scripts, impacting the confidentiality, integrity, and availability of the system.

The Impact of CVE-2023-35153

This vulnerability has a base score of 9.1 (Critical) on the CVSS scale. It poses a high risk as it allows attackers to compromise sensitive data, modify content, and disrupt services, potentially leading to serious security breaches.

Technical Details of CVE-2023-35153

The vulnerability description, affected systems and versions, and exploitation mechanism are detailed below.

Vulnerability Description

By adding a specific class on a page and setting a payload in the page title, users can trigger a stored cross-site scripting attack. Any user accessing the vulnerable page is then at risk of executing the malicious payload.

Affected Systems and Versions

XWiki Platform versions affected by this vulnerability include 5.4.4 to 14.4.8, 14.10.4, and 15.0-rc-1. Users of these versions are at risk of exploitation unless mitigating steps are taken.

Exploitation Mechanism

Attackers with edit rights can abuse the

AppWithinMinutes.FormFieldCategoryClass

to inject malicious payloads. Upon visiting the

/xwiki/bin/view/AppWithinMinutes/ClassEditSheet

page, the payload gets executed, leading to potential data compromise.

Mitigation and Prevention

To safeguard systems against CVE-2023-35153, immediate steps should be taken along with long-term security practices.

Immediate Steps to Take

Users are advised to update XWiki Platform to the patched versions (14.4.8, 14.10.4, 15.0) immediately. Additionally, applying the provided workaround by patching the

AppWithinMinutes.ClassEditSheet

can help mitigate the risk.

Long-Term Security Practices

It is recommended to follow secure coding practices, regularly update software, and conduct security audits to identify and address potential vulnerabilities promptly.

Patching and Updates

Regularly check for security patches and updates from XWiki to ensure that the platform is protected against known vulnerabilities.