CVE-2023-37908
📋 TL;DR
CVE-2023-37908 is a cross-site scripting (XSS) vulnerability in XWiki Rendering that allows attackers to inject arbitrary HTML/JavaScript via malicious links. When exploited against privileged users with programming rights, it can lead to server-side code execution, compromising the entire XWiki instance. All XWiki instances using affected versions are vulnerable.
💻 Affected Systems
- XWiki Rendering
- XWiki Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of XWiki instance through server-side code execution with programming rights, leading to data theft, system takeover, and availability disruption.
Likely Case
Session hijacking, privilege escalation, and data exfiltration through XSS against authenticated users.
If Mitigated
Limited to client-side XSS impact if no privileged users interact with malicious content.
🎯 Exploit Status
Exploitation requires user interaction (hovering over malicious link) but is straightforward once malicious content is injected. No authentication needed to inject content if content creation is allowed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XWiki 14.10.4 or 15.0 RC1 and later
Vendor Advisory: https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739
Restart Required: Yes
Instructions:
1. Backup your XWiki instance. 2. Upgrade to XWiki 14.10.4 or 15.0 RC1+. 3. Restart the XWiki application server. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds apart from upgrading.
🧯 If You Can't Patch
- Restrict content creation to trusted users only
- Implement web application firewall (WAF) rules to block suspicious HTML attribute patterns
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via admin interface or by examining the installation directory. If version is between 14.6-rc-1 and 14.10.3, or pre-15.0 RC1, it's vulnerable.Check Version:
Check XWiki admin dashboard or examine WEB-INF/lib/xwiki-rendering-*.jar versionVerify Fix Applied:
After upgrade, verify version is 14.10.4+ or 15.0 RC1+. Test by attempting to inject malicious attributes in content - they should be properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual content creation/modification patterns
- JavaScript execution errors in server logs
- Suspicious attribute names in rendered content
Network Indicators:
- HTTP requests containing malicious attribute patterns like data-xwiki-translated-attribute- with script content
SIEM Query:
web.logs: "data-xwiki-translated-attribute-" AND ("javascript:" OR "onmouseover" OR "onclick")🔗 References
- https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp
- https://jira.xwiki.org/browse/XRENDERING-697
- https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp
- https://jira.xwiki.org/browse/XRENDERING-697
