CVE-2023-29202
Published: 15 April 2023
Summary
CVE-2023-29202 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a stored cross-site scripting flaw (CWE-79) in the RSS macro bundled with XWiki Commons. When the macro parameter "content" is set to "true", feed item content is rendered directly into HTML output without sanitization, permitting arbitrary script injection. The affected component is the rendering-macro-rss JAR present in XWiki installations prior to the 14.6 release line.
An attacker able to supply or control an RSS feed URL can embed malicious JavaScript. When a user with programming rights subsequently views the rendered page, the script executes in that user's context, enabling privilege escalation, remote code execution, content modification, or data exfiltration within the wiki.
Advisories and patches indicate the issue was resolved in XWiki 14.6 RC1 by adding proper content cleaning before display. As a temporary mitigation, administrators can remove the macro entirely by deleting WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar from the deployed web application.
The EPSS score remains flat at 0.1102 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1264
Vulnerability details
XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was…
more
set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.