CVE-2022-36096: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2022-09-08T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml
Commit date: 2022-04-21 15:59:07 +0200
Commit message: XWIKI-19613: Bad display in deleted attachments

Diff: diff --git a/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml b/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml
index 914b34708dc1..d63edeb36f22 100644
--- a/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml
+++ b/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml
@@ -331,17 +331,17 @@
  * @param i the index of the row in the list of entries
  * @param table the LiveTable javascript object
  */
 XWiki.index.trash.attachments.displayEntry = function (row, i, table) {
   var tr = new Element('tr'); // The resulting table row
-  var file = new Element('a', {'href' : row.url}).update(row.filename);
+  var file = new Element('a', {'href' : row.url}).update((row.filename || '').escapeHTML());
   tr.appendChild(new Element('td').update(file));
-  var doc = new Element('a', {'href' : row.documentUrl}).update(row.title);
+  var doc = new Element('a', {'href' : row.documentUrl}).update((row.title || '').escapeHTML());
   doc.appendChild(document.createTextNode(' (' + row.docName + ')'));
   tr.appendChild(new Element('td').update(doc));
-  tr.appendChild(new Element('td').update(row.date));
-  var deleter = new Element('a', {'href' : row.deleterurl}).update(row.deletername);
+  tr.appendChild(new Element('td').update((row.date || '').escapeHTML()));
+  var deleter = new Element('a', {'href' : row.deleterurl}).update((row.deletername || '').escapeHTML());
   tr.appendChild(new Element('td').update(deleter));
   var actions = new Element('td', {'class' : 'itemActions'});
   if(row.canDelete) {
     var delete_ = new Element('a', {
         'href' : row.deleteUrl,

Vulnerable code:   var file = new Element('a', {'href' : row.url}).update(row.filename);
  var doc = new Element('a', {'href' : row.documentUrl}).update(row.title);
  tr.appendChild(new Element('td').update(row.date));
  var deleter = new Element('a', {'href' : row.deleterurl}).update(row.deletername);
Fixed code:   var file = new Element('a', {'href' : row.url}).update((row.filename || '').escapeHTML());
  var doc = new Element('a', {'href' : row.documentUrl}).update((row.title || '').escapeHTML());
  tr.appendChild(new Element('td').update((row.date || '').escapeHTML()));
  var deleter = new Element('a', {'href' : row.deleterurl}).update((row.deletername || '').escapeHTML());