CVE-2023-35155
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers to inject malicious JavaScript via specially crafted URLs. When exploited, it enables execution of arbitrary code in victims' browsers. All XWiki installations running vulnerable versions are affected.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, defacement of wiki pages, or redirection to phishing sites.
If Mitigated
Limited impact if proper Content Security Policy (CSP) headers are implemented and user input validation is enforced.
🎯 Exploit Status
The advisory includes a working exploit URL. Attack requires user interaction (clicking malicious link) but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.4.8, 14.10.4, or 15.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fwwj-wg89-7h4c
Restart Required: Yes
Instructions:
1. Backup your XWiki installation. 2. Download patched version from xwiki.org. 3. Follow XWiki upgrade documentation. 4. Restart application server. 5. Verify fix by testing share functionality.
🔧 Temporary Workarounds
Disable Share Feature
allTemporarily disable the vulnerable share functionality
Edit xwiki.cfg and set 'xwiki.share.enabled=false'
Implement WAF Rules
allBlock malicious patterns in the share parameters
Add WAF rule to block URLs containing '<img src onerror=' patterns in target parameter
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to block inline JavaScript execution
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test with the provided exploit URL pattern: /xwiki/bin/view/Main/?viewer=share&send=1&target=<img src onerror=alert(document.domain)>Check Version:
Check XWiki version in Administration → About or via REST APIVerify Fix Applied:
After patching, test the same exploit URL should not execute JavaScript📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'viewer=share' parameter containing HTML/JavaScript patterns
- Unusual share feature usage patterns
Network Indicators:
- URLs with encoded HTML entities in target parameter
- Requests to share endpoint with suspicious payloads
SIEM Query:
web.url:*viewer=share* AND (web.param.target:*%3C* OR web.param.target:*onerror*)