Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5243

Reflected XSS in edit(wiki|wysiwyg|wysiwygnew).vm

Details

    • security, xss, patch
    • Integration
    • Trivial

    Description

      Exactly the same mistakes in all 3 templates. Injection via "section", "template" and "xredirect" example:

      http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwiki&section=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwiki&template=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwiki&xredirect=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwysiwygnew&section=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwysiwygnew&template=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test?xpage=editwysiwygnew&xredirect=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

http://localhost:8080/xwiki/bin/view/Main/Test2?xpage=editwysiwyg&section=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test2?xpage=editwysiwyg&template=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/Test2?xpage=editwysiwyg&xredirect=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-5235 Reflected XSS over section parameter

          • Major - Major loss of function.
          • Closed

          Activity

            [XWIKI-5243] Reflected XSS in edit(wiki|wysiwyg|wysiwygnew).vm
            nickless Alex Busenius added a comment - - edited

            Fixed in r30675, 2.4 branch in r30791

            nickless Alex Busenius added a comment - - edited Fixed in r30675, 2.4 branch in r30791
            nickless Alex Busenius added a comment -

            Added fix, tests are in escaping-tests/.

            nickless Alex Busenius added a comment - Added fix, tests are in escaping-tests/.
            nickless Alex Busenius added a comment -

            Escaping test result:

            * Parameter: "section"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwyg.vm&xpage=xpart&language=en
  List of validation errors:
    line    4  column 105  FATAL: Unescaped apostrophe character
    line    4  column 101  FATAL: Unescaped quote character
* Parameter: "template"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    3  column  48  FATAL: Unescaped apostrophe character
    line    3  column  44  FATAL: Unescaped quote character
* Parameter: "xredirect"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    5  column  49  FATAL: Unescaped apostrophe character
    line    5  column  45  FATAL: Unescaped quote character

* Parameter: "section"
  Tested file: templates/editwysiwygnew.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwygnew.vm&xpage=xpart&language=en
  List of validation errors:
    line    4  column 105  FATAL: Unescaped apostrophe character
    line    4  column 101  FATAL: Unescaped quote character
* Parameter: "template"
  Tested file: templates/editwysiwygnew.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwygnew.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    3  column  48  FATAL: Unescaped apostrophe character
    line    3  column  44  FATAL: Unescaped quote character
* Parameter: "xredirect"
  Tested file: templates/editwysiwygnew.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwygnew.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    5  column  49  FATAL: Unescaped apostrophe character
    line    5  column  45  FATAL: Unescaped quote character

* Parameter: "section"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwyg.vm&xpage=xpart&language=en
  List of validation errors:
    line    4  column 105  FATAL: Unescaped apostrophe character
    line    4  column 101  FATAL: Unescaped quote character
* Parameter: "template"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    3  column  48  FATAL: Unescaped apostrophe character
    line    3  column  44  FATAL: Unescaped quote character
* Parameter: "xredirect"
  Tested file: templates/editwysiwyg.vm
  URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en
  List of validation errors:
    line    5  column  49  FATAL: Unescaped apostrophe character
    line    5  column  45  FATAL: Unescaped quote character
            nickless Alex Busenius added a comment - Escaping test result: * Parameter: "section" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwyg.vm&xpage=xpart&language=en List of validation errors: line 4 column 105 FATAL: Unescaped apostrophe character line 4 column 101 FATAL: Unescaped quote character * Parameter: "template" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 3 column 48 FATAL: Unescaped apostrophe character line 3 column 44 FATAL: Unescaped quote character * Parameter: "xredirect" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 5 column 49 FATAL: Unescaped apostrophe character line 5 column 45 FATAL: Unescaped quote character * Parameter: "section" Tested file: templates/editwysiwygnew.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwygnew.vm&xpage=xpart&language=en List of validation errors: line 4 column 105 FATAL: Unescaped apostrophe character line 4 column 101 FATAL: Unescaped quote character * Parameter: "template" Tested file: templates/editwysiwygnew.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwygnew.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 3 column 48 FATAL: Unescaped apostrophe character line 3 column 44 FATAL: Unescaped quote character * Parameter: "xredirect" Tested file: templates/editwysiwygnew.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwygnew.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 5 column 49 FATAL: Unescaped apostrophe character line 5 column 45 FATAL: Unescaped quote character * Parameter: "section" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?section=aaa%22bbb%27ccc%3Eddd%3Ceee&skin=default&vm=editwysiwyg.vm&xpage=xpart&language=en List of validation errors: line 4 column 105 FATAL: Unescaped apostrophe character line 4 column 101 FATAL: Unescaped quote character * Parameter: "template" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&template=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 3 column 48 FATAL: Unescaped apostrophe character line 3 column 44 FATAL: Unescaped quote character * Parameter: "xredirect" Tested file: templates/editwysiwyg.vm URL: http://localhost:8080/xwiki/bin/view/Main/WebHome?skin=default&vm=editwysiwyg.vm&xredirect=aaa%22bbb%27ccc%3Eddd%3Ceee&xpage=xpart&language=en List of validation errors: line 5 column 49 FATAL: Unescaped apostrophe character line 5 column 45 FATAL: Unescaped quote character

            People

              nickless Alex Busenius
              nickless Alex Busenius
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: