Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5404

XSS in editclass.vm

    XMLWordPrintable

Details

    • security, xss, patch
    • Integration
    • Easy

    Description

      Multiple reflected & stored XSS issues all over the place.

      Escaping test result:

      org.xwiki.escaping.framework.EscapingError: Escaping test for XWIKI-5404 failed.
        Tested file: templates/editclass.vm
        URL: http://127.0.0.1:8080/xwiki/bin/edit/aaa%22bbb%27ccc%3Eddd%3Ceee/aaa%22bbb%27ccc%3Eddd%3Ceee?editor=class&language=en
        List of validation errors:
          line  268  column  45  FATAL: Unescaped apostrophe character
          line  268  column  41  FATAL: Unescaped quote character
          line  269  column 137  FATAL: Unescaped apostrophe character
          line  269  column 133  FATAL: Unescaped quote character
          line  283  column  22  FATAL: Unescaped apostrophe character
          line  283  column  42  FATAL: Unescaped apostrophe character
          line  283  column  18  FATAL: Unescaped quote character
          line  283  column  38  FATAL: Unescaped quote character
          line  284  column  24  FATAL: Unescaped apostrophe character
          line  284  column  44  FATAL: Unescaped apostrophe character
          line  284  column  96  FATAL: Unescaped apostrophe character
          line  284  column 116  FATAL: Unescaped apostrophe character
          line  284  column  20  FATAL: Unescaped quote character
          line  284  column  40  FATAL: Unescaped quote character
          line  284  column  92  FATAL: Unescaped quote character
          line  284  column 112  FATAL: Unescaped quote character
          line  307  column  24  FATAL: Unescaped apostrophe character
          line  307  column  44  FATAL: Unescaped apostrophe character
          line  307  column  20  FATAL: Unescaped quote character
          line  307  column  40  FATAL: Unescaped quote character
      
      org.xwiki.escaping.framework.EscapingError: Escaping test for page name failed.
        Tested file: templates/editclass.vm
        URL: http://127.0.0.1:8080/xwiki/bin/view/Main/aaa%22bbb%27ccc%3Eddd%3Ceee?skin=default&vm=editclass.vm&xpage=xpart&language=en
        List of validation errors:
          line   63  column  27  FATAL: Unescaped apostrophe character
          line   63  column  23  FATAL: Unescaped quote character
          line   64  column  29  FATAL: Unescaped apostrophe character
          line   64  column  86  FATAL: Unescaped apostrophe character
          line   64  column  25  FATAL: Unescaped quote character
          line   64  column  82  FATAL: Unescaped quote character
          line   87  column  29  FATAL: Unescaped apostrophe character
          line   87  column  25  FATAL: Unescaped quote character
      
      org.xwiki.escaping.framework.EscapingError: Escaping test for space name failed.
        Tested file: templates/editclass.vm
        URL: http://127.0.0.1:8080/xwiki/bin/view/aaa%22bbb%27ccc%3Eddd%3Ceee/WebHome?skin=default&vm=editclass.vm&xpage=xpart&language=en
        List of validation errors:
          line   63  column  22  FATAL: Unescaped apostrophe character
          line   63  column  18  FATAL: Unescaped quote character
          line   64  column  24  FATAL: Unescaped apostrophe character
          line   64  column  84  FATAL: Unescaped apostrophe character
          line   64  column  20  FATAL: Unescaped quote character
          line   64  column  80  FATAL: Unescaped quote character
          line   87  column  24  FATAL: Unescaped apostrophe character
          line   87  column  20  FATAL: Unescaped quote character
      

      Attachments

        Activity

          People

            nickless Alex Busenius
            nickless Alex Busenius
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: