CVE-2023-28836: Wagtail Cross-Site Scripting Vulnerability

Q: What is CVE-2023-28836?

CVE-2023-28836 is a security vulnerability in Wagtail involving Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Q: Which Wagtail versions are affected?

Affected versions include releases prior to 4.1.4, 4.2.2 across affected packages: wagtail.

Q: What version fixes CVE-2023-28836?

Upgrading to 4.1.4, 4.2.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is wagtail affected?

Yes, wagtail is affected in releases prior to 4.1.4, 4.2.2. Upgrade your dependency to 4.1.4, 4.2.2 or later.

Q: What is the CVSS score of CVE-2023-28836?

CVE-2023-28836 has a CVSS v3.1 base score of 6.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2023-28836?

CVE-2023-28836 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

Q: How can I check PyPI dependencies for CVE-2023-28836?

Run the dependency tree command: 'pip show wagtail'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-5286-f2rf-35c2

CVSS 6.4

CWE-79

Published 2023-04-03

Advisory Summary

CVE-2023-28836 is a HIGH (CVSS 6.4) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Wagtail libraries in the PyPI ecosystem. The issue involves wagtail vulnerable to stored cross-site scripting attack via modeladmin views. Remediation is available by upgrading affected packages to version 4.1.4, 4.2.2.

CVE-2023-28836 at a Glance

CVE Identifier CVE-2023-28836

GHSA Identifier GHSA-5286-f2rf-35c2

Severity HIGH

CVSS v3.1 Base Score 6.4

CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Product Wagtail

Package Ecosystem PyPI

Published Date 2023-04-03

Last Updated 2024-11-19

Security Impact

CVSS: 6.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity High (AC:H)

Privileges Required High (PR:H)

User Interaction Required (UI:R)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2023-28836

To remediate this vulnerability, upgrade all affected Wagtail dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

wagtail fixed: 4.1.4

pip install wagtail>=4.1.4

wagtail fixed: 4.2.2

pip install wagtail>=4.2.2

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show wagtail

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2023-28836, inspect your installed packages using pip:

pip show wagtail

Analyze the terminal output to locate any version of Wagtail in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.1.4), your application is affected.

Note: The pip show wagtail command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Wagtail, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact A stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled. - For page, the vulnerability is in the "Choose a parent page" ModelAdmin view ([`ChooseParentView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview)), available when managing pages via ModelAdmin. - For documents, the vulnerability is in the ModelAdmin Inspect view ([`InspectView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview)) when displaying document fields. ### Patches Patched versions have been released as Wagtail 4.1.4 (for the LTS 4.1 branch) and Wagtail 4.2.2 (for the current 4.2 branch). ### Workarounds Site owners who are unable to upgrade to the new versions can disable or override the corresponding functionality. #### `ChooseParentView` For [`ChooseParentView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#modeladmin-choose-parent-view-class): - Disable ModelAdmin for all page models. - Or provide a custom view via [`choose_parent_view_class`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#id4), with the custom view overriding the `get_form` method. One of those steps need to be applied for every `ModelAdmin` class hooked into Wagtail where the model is a Wagtail `Page` or sub-class. Here is an example of implementing the custom `ChooseParentView` with patched HTML escaping: ```python from django import forms from django.utils.translation import gettext as _ from wagtail.contrib.modeladmin.views import ChooseParentView from wagtail.contrib.modeladmin.forms import ParentChooserForm class PatchedPageChoiceField(forms.ModelChoiceField): """PageChoiceField with plain-text breadcrumbs to patch stored XSS.""" def label_from_instance(self, obj): bits = [] for ancestor in ( obj.get_ancestors(inclusive=True).exclude(depth=1).specific(defer=True) ): bits.append(ancestor.get_admin_display_title()) return ' | '.join(bits) class PatchedParentChooserForm(ParentChooserForm): """ParentChooserForm with custom parent_page to patch stored XSS.""" parent_page = PatchedPageChoiceField( label=_("Parent page"), required=True, empty_label=None, queryset=Page.objects.none(), widget=forms.RadioSelect(), ) class PatchedChooseParentView(ChooseParentView): """ChooseParentView with custom get_form patch stored XSS.""" def get_form(self, request): parents = self.permission_helper.get_valid_parent_pages(request.user) return PatchedParentChooserForm(parents, request.POST or None) ``` #### `InspectView` For [`InspectView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview): - Remove `inspect_view_enabled=True` or set it to False to disable the view. - Or use [`inspect_view_fields`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#modeladmin-inspect-view-fields) or [`inspect_view_fields_exclude`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#modeladmin-inspect-view-fields-exclude) to prevent displaying document fields in the views. - Or provide a custom view via [`inspect_view_class`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#id12), with the custom view overriding the `get_document_field_display` method. One of those steps need to be applied for every `ModelAdmin` class hooked into Wagtail where `inspect_view_enabled=True`. Here is an example of implementing the custom `InspectView` with patched HTML escaping: ```python from django.template.defaultfilters import filesizeformat from django.utils.html import format_html from wagtail.contrib.modeladmin.views import InspectView class PatchedInspectView(InspectView): """InspectView with override to patch stored XSS vulnerability.""" def get_document_field_display(self, field_name, field): """Render a link to a document""" document = getattr(self.instance, field_name) if document: return format_html( '<a href="{}">{} <span class="meta">({}, {})</span></a>', document.url, document.title, document.file_extension.upper(), filesizeformat(document.file.size), ) return self.model_admin.get_empty_value_display(field_name) ```

CVE-2023-28836 Affected Wagtail Versions

2 component(s)

Fixed Versions:

4.1.44.2.2

Product / Package	Ecosystem	Affected Versions	Fixed Version
wagtail pypi/wagtail	PyPI	≥ 1.5 < 4.1.4	4.1.4
wagtail pypi/wagtail	PyPI	≥ 4.2 < 4.2.2	4.2.2

References

GitHub Advisory / Wiki ADVISORY

https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2

NVD — CVE-2023-28836 NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-28836

Security Fix Commit FIX COMMIT

https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62

Security Fix Commit FIX COMMIT

https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713

Security Fix Commit FIX COMMIT

https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af

Security Fix Commit FIX COMMIT

https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91

Wagtail Security Information SECURITY

https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview

Wagtail Security Information SECURITY

https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview

Wagtail Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-55.yaml

Wagtail Source Repository REPOSITORY

https://github.com/wagtail/wagtail

Wagtail Release RELEASE

https://github.com/wagtail/wagtail/releases/tag/v4.1.4

Wagtail Release RELEASE

https://github.com/wagtail/wagtail/releases/tag/v4.2.2

Frequently Asked Questions

What is CVE-2023-28836?

CVE-2023-28836 is a security vulnerability in Wagtail involving Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Which Wagtail versions are affected?

Affected versions include releases prior to 4.1.4, 4.2.2 across affected packages: wagtail.

What version fixes CVE-2023-28836?

Upgrading to 4.1.4, 4.2.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Is wagtail affected?

Yes, wagtail is affected in releases prior to 4.1.4, 4.2.2. Upgrade your dependency to 4.1.4, 4.2.2 or later.

What is the CVSS score of CVE-2023-28836?

CVE-2023-28836 has a CVSS v3.1 base score of 6.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2023-28836?

CVE-2023-28836 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

How can I check PyPI dependencies for CVE-2023-28836?

Run the dependency tree command: 'pip show wagtail'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5286-f2rf-35c2",
  "modified" : "2024-11-19T16:19:21Z",
  "published" : "2023-04-03T17:25:27Z",
  "aliases" : [ "CVE-2023-28836" ],
  "summary" : "Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views",
  "details" : "### Impact\n\nA stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled.\n\n- For page, the vulnerability is in the \"Choose a parent page\" ModelAdmin view ([`ChooseParentView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview)), available when managing pages via ModelAdmin.\n- For documents, the vulnerability is in the ModelAdmin Inspect view ([`InspectView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview)) when displaying document fields.\n\n### Patches\n\nPatched versions have been released as Wagtail 4.1.4 (for the LTS 4.1 branch) and Wagtail 4.2.2 (for the current 4.2 branch).\n\n### Workarounds\n\nSite owners who are unable to upgrade to the new versions can disable or override the corresponding functionality.\n\n#### `ChooseParentView`\n\nFor [`ChooseParentView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#modeladmin-choose-parent-view-class):\n\n- Disable ModelAdmin for all page models.\n- Or provide a custom view via [`choose_parent_view_class`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#id4), with the custom view overriding the `get_form` method.\n\nOne of those steps need to be applied for every `ModelAdmin` class hooked into Wagtail where the model is a Wagtail `Page` or sub-class. Here is an example of implementing the custom `ChooseParentView` with patched HTML escaping:\n\n```python\nfrom django import forms\nfrom django.utils.translation import gettext as _\nfrom wagtail.contrib.modeladmin.views import ChooseParentView\nfrom wagtail.contrib.modeladmin.forms import ParentChooserForm\n\n\nclass PatchedPageChoiceField(forms.ModelChoiceField):\n    \"\"\"PageChoiceField with plain-text breadcrumbs to patch stored XSS.\"\"\"\n    def label_from_instance(self, obj):\n        bits = []\n        for ancestor in (\n            obj.get_ancestors(inclusive=True).exclude(depth=1).specific(defer=True)\n        ):\n            bits.append(ancestor.get_admin_display_title())\n        return ' | '.join(bits)\n\n\nclass PatchedParentChooserForm(ParentChooserForm):\n    \"\"\"ParentChooserForm with custom parent_page to patch stored XSS.\"\"\"\n    parent_page = PatchedPageChoiceField(\n        label=_(\"Parent page\"),\n        required=True,\n        empty_label=None,\n        queryset=Page.objects.none(),\n        widget=forms.RadioSelect(),\n    )\n\n\nclass PatchedChooseParentView(ChooseParentView):\n    \"\"\"ChooseParentView with custom get_form patch stored XSS.\"\"\"\n    def get_form(self, request):\n        parents = self.permission_helper.get_valid_parent_pages(request.user)\n        return PatchedParentChooserForm(parents, request.POST or None)\n```\n\n#### `InspectView`\n\nFor [`InspectView`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview):\n\n- Remove `inspect_view_enabled=True` or set it to False to disable the view.\n- Or use [`inspect_view_fields`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#modeladmin-inspect-view-fields) or [`inspect_view_fields_exclude`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#modeladmin-inspect-view-fields-exclude) to prevent displaying document fields in the views.\n- Or provide a custom view via [`inspect_view_class`](https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#id12), with the custom view overriding the `get_document_field_display` method.\n\nOne of those steps need to be applied for every `ModelAdmin` class hooked into Wagtail where `inspect_view_enabled=True`. Here is an example of implementing the custom `InspectView` with patched HTML escaping:\n\n```python\nfrom django.template.defaultfilters import filesizeformat\nfrom django.utils.html import format_html\nfrom wagtail.contrib.modeladmin.views import InspectView\n\n\nclass PatchedInspectView(InspectView):\n    \"\"\"InspectView with override to patch stored XSS vulnerability.\"\"\"\n    def get_document_field_display(self, field_name, field):\n        \"\"\"Render a link to a document\"\"\"\n        document = getattr(self.instance, field_name)\n        if document:\n            return format_html(\n                '<a href=\"{}\">{} <span class=\"meta\">({}, {})</span></a>',\n                document.url,\n                document.title,\n                document.file_extension.upper(),\n                filesizeformat(document.file.size),\n            )\n        return self.model_admin.get_empty_value_display(field_name)\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "wagtail"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5"
      }, {
        "fixed" : "4.1.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "wagtail"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.2"
      }, {
        "fixed" : "4.2.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-28836"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91"
  }, {
    "type" : "WEB",
    "url" : "https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview"
  }, {
    "type" : "WEB",
    "url" : "https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-55.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/wagtail/wagtail"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/releases/tag/v4.1.4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wagtail/wagtail/releases/tag/v4.2.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-04-03T17:25:27Z",
    "nvd_published_at" : "2023-04-03T17:15:00Z"
  }
}

CVSS V3

6.4 HIGH

Attack Vector Network (AV:N)

Attack Complexity High (AC:H)

Privileges Required High (PR:H)

User Interaction Required (UI:R)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-5286-f2rf-35c2
Schema Version: 1.4.0
Published: 2023-04-03 17:25
Last Modified: 2024-11-19 16:19
Database Record File: advisories/github-reviewed/2023/04/GHSA-5286-f2rf-35c2/GHSA-5286-f2rf-35c2.json