CVE-2023-22457: Cross-Site Request Forgery (CSRF) (CWE-352)
value: CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-01-04T15:15Z
Repository: https://github.com/xwiki-contrib/application-ckeditor
Language: JavaScript
Files changed: application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js, application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml
Commit date: 2022-07-05 15:30:25 +0200
Commit message: CKEDITOR-475: Add form token check to HTMLConverter

Diff: diff --git a/application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js b/application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js
index 87d3fbb..3d10b3d 100644
--- a/application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js
+++ b/application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js
@@ -58,11 +58,12 @@
         // We need the source document to be the current document when the HTML conversion is performed in order to make
         // sure relative references within the edited content are properly resolved and serialized.
         htmlConverter: sourceDocument.getURL('get', $.param({
           sheet: 'CKEditor.HTMLConverter',
           outputSyntax: 'plain',
-          language: $('html').attr('lang') || ''
+          language: $('html').attr('lang') || '',
+          formToken: document.documentElement.dataset.xwikiFormToken || ''
         }))
       }, editor.config['xwiki-source']);
 
       // The source command is not registered if the editor is loaded in-line.
       var sourceCommand = editor.getCommand('source');
diff --git a/application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml b/application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml
index e377d52..0cadf96 100644
--- a/application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml
+++ b/application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml
@@ -39,11 +39,11 @@
   <content>{{include reference="CKEditor.VelocityMacros"/}}
 
 {{velocity wiki="false"}}
 #set ($toHTML = $request.toHTML == 'true')
 #set ($fromHTML = $request.fromHTML == 'true')
-#if ($toHTML || $fromHTML)
+#if (($toHTML || $fromHTML) &amp;&amp; $services.csrf.isTokenValid($request.formToken))
   #set ($text = "$!request.text")
   #set ($stripHTMLEnvelope = $request.stripHTMLEnvelope == 'true')
   #set ($output = "#ckeditor_convert($text $toHTML $fromHTML $stripHTMLEnvelope)")
   #set ($characterEncoding = 'utf-8')
   ## Make sure the Character Encoding response header matches the character encoding used to write the response and

Vulnerable code:           language: $('html').attr('lang') || ''
#if ($toHTML || $fromHTML)
Fixed code:           language: $('html').attr('lang') || '',
          formToken: document.documentElement.dataset.xwikiFormToken || ''
#if (($toHTML || $fromHTML) &amp;&amp; $services.csrf.isTokenValid($request.formToken))