CVE-2023-35159: Xwiki platform web templates Cross-Site Scripting Vulnerability

CRITICAL
Advisory Identifier: GHSA-x234-mg7q-m8g8
Share
CVSS 9.6
CWE-87 CWE-79
Published
Advisory Summary

CVE-2023-35159 is a CRITICAL (CVSS 9.6) cross-site scripting vulnerability (CWE-87: Improper Neutralization of Alternate XSS Syntax) affecting Xwiki platform web templates libraries in the Maven ecosystem. The issue involves xwiki platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template. Remediation is available by upgrading affected packages to version 14.10.5, 15.1-rc-1.

CVE-2023-35159 at a Glance

CVE Identifier CVE-2023-35159
GHSA Identifier GHSA-x234-mg7q-m8g8
Severity CRITICAL
CVSS v3.1 Base Score 9.6
CWE Classification CWE-87: Improper Neutralization of Alternate XSS Syntax
Affected Product Xwiki platform web templates
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2023-35159

To remediate this vulnerability, upgrade all affected Xwiki platform web templates dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.xwiki.platform:xwiki-platform-web-templates fixed: 14.10.5 
<dependency>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-web-templates</artifactId>
    <version>14.10.5</version>
</dependency>
org.xwiki.platform:xwiki-platform-web-templates fixed: 15.1-rc-1 
<dependency>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-web-templates</artifactId>
    <version>15.1-rc-1</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.xwiki.platform

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2023-35159, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.xwiki.platform

Analyze the terminal output to locate any version of Xwiki platform web templates in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 14.10.5), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.xwiki.platform command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-87: Improper Neutralization of Alternate XSS Syntax, where the product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax. In Xwiki platform web templates, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain) This vulnerability exists since XWiki 3.4-milestone-1. ### Patches The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. ### Workarounds It's possible to workaround the vulnerability by editing the template deletespace.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets. ### References * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20612 * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583 * Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

CVE-2023-35159 Affected Xwiki platform web templates Versions

2 component(s)
Fixed Versions:
14.10.515.1-rc-1
Product / Package Ecosystem Affected Versions Fixed Version
org.xwiki.platform:xwiki-platform-web-templates
maven/org.xwiki.platform/xwiki-platform-web-templates
Maven
≥ 3.4-milestone-1
< 14.10.5
14.10.5
org.xwiki.platform:xwiki-platform-web-templates
maven/org.xwiki.platform/xwiki-platform-web-templates
Maven
≥ 15.0-rc-1
< 15.1-rc-1
15.1-rc-1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x234-mg7q-m8g8
NVD — CVE-2023-35159 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-35159
Security Fix Commit FIX COMMIT
https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34
Xwiki platform web templates Source Repository REPOSITORY
https://github.com/xwiki/xwiki-platform
jira.xwiki.org/browse/xwiki-20583 WEB
https://jira.xwiki.org/browse/XWIKI-20583
jira.xwiki.org/browse/xwiki-20612 WEB
https://jira.xwiki.org/browse/XWIKI-20612

Frequently Asked Questions

What is CVE-2023-35159?
CVE-2023-35159 is a security vulnerability in Xwiki platform web templates involving XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template under CWE-87: Improper Neutralization of Alternate XSS Syntax.
Which Xwiki platform web templates versions are affected?
Affected versions include releases prior to 14.10.5, 15.1-rc-1 across affected packages: org.xwiki.platform:xwiki-platform-web-templates.
What version fixes CVE-2023-35159?
Upgrading to 14.10.5, 15.1-rc-1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is xwiki-platform-web-templates affected?
Yes, org.xwiki.platform:xwiki-platform-web-templates is affected in releases prior to 14.10.5, 15.1-rc-1. Upgrade your dependency to 14.10.5, 15.1-rc-1 or later.
What is the CVSS score of CVE-2023-35159?
CVE-2023-35159 has a CVSS v3.1 base score of 9.6 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
What CWE is associated with CVE-2023-35159?
CVE-2023-35159 is classified under CWE-87: Improper Neutralization of Alternate XSS Syntax (The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.).
How can I check Maven dependencies for CVE-2023-35159?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.xwiki.platform'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x234-mg7q-m8g8",
  "modified" : "2023-06-22T19:59:47Z",
  "published" : "2023-06-22T19:59:47Z",
  "aliases" : [ "CVE-2023-35159" ],
  "summary" : "XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template",
  "details" : "### Impact\nUsers are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).\nIt's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:\n\n> xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain)\n\nThis vulnerability exists since XWiki 3.4-milestone-1.\n\n### Patches\nThe vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.\n\n### Workarounds\n\nIt's possible to workaround the vulnerability by editing the template deletespace.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.\n\n### References\n\n  * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20612\n  * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583\n  * Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-web-templates"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.4-milestone-1"
      }, {
        "fixed" : "14.10.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-web-templates"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "15.0-rc-1"
      }, {
        "fixed" : "15.1-rc-1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x234-mg7q-m8g8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-35159"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/xwiki/xwiki-platform"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-20583"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-20612"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-87" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-06-22T19:59:47Z",
    "nvd_published_at" : "2023-06-23T19:15:09Z"
  }
}