CSS Injection in Comments

About the Vulnerability

This vulnerability is a CSS injection issue that allows an attacker to inject arbitrary styles into the rendered HTML of the page via a macro (e.g. warning) in the XWiki platform. Specifically, the injected CSS is not properly sanitised, allowing full control over layout, positioning, and visual behaviour of elements.

By injecting carefully crafted inline styles within a valid macro wrapper, the attacker can render a full-page invisible link that redirects users to an attacker-controlled site when clicked, without requiring JavaScript or interaction beyond a normal click anywhere on the page.

This was all tested and working within Xwiki 16.10.10. 

Walkthrough of the Vulnerability

1. The vulnerable field is a macro-enabled field such as {{warning}}, which accepts HTML-like content.

1. An attacker crafts a payload that injects a <div> with a style attribute using position: fixed;, width: 100vw; height: 100vh;, and opacity: 0; to cover the entire viewport invisibly.

1. Inside that div, a <a> tag is used to link to a malicious external site. The entire page becomes one large clickable area.

1. Once a user clicks anywhere on the page, they are taken to the attacker's site without any visual indication or warning.

1. Exploit Code:

<div class="box" style="position:fixed;top:0;left:0;width:100vw;height:100vh;opacity:0;z-index:9999;">
  <a href="https://attacker-site.com" style="display:block;width:100vw;height:100vh;"></a>
</div>

This payload can be URL-encoded and embedded inside a macro like {{warning}} or a comment block depending on the context allowed by the XWiki instance.

Impact

This vulnerability enables a range of deceptive interaction attacks, including:

• Forced navigation: Users are silently redirected when clicking anywhere on the page.

• UI Redress (Clickjacking-style): Attackers can overlay fake UI elements (buttons, forms, links) and direct users to malicious pages.

• Phishing support: Can be used in social engineering campaigns by chaining with open redirects or branding imitation.

• Bypasses CSP & JavaScript restrictions: Because it relies solely on CSS/HTML layout control, it often bypasses common security headers (except a strict Content Security Policy that blocks inline styles or limits style-src).

While there is no JavaScript execution, the ability to invisibly hijack user interaction and initiate off-site navigation gives it moderate to high security relevance.

CVSS3.1 - 6.1

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Attribution

Tomas Keech - Sentrium Security Ltd