CVE-2023-35162: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm
Commit date: 2023-02-03 10:29:52 +0100
Commit message: XWIKI-20342: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm
index beb6d52c7502c..d773310a588b3 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm
@@ -43,11 +43,14 @@
           #set($editorUrl = $tdoc.getURL("edit", "editor=wiki&amp;$docvariant"))
         #end
       #end
     #end
   #end
-<form id="backtoedit" class="buttons" action="$!{escapetool.xml($editorUrl)}" method="post">
+  ## We use the wiki editor as fallback url since it's the one supposed to work in all conditions.
+  #set ($fallbackUrl = $tdoc.getURL("edit", "editor=wiki&amp;$docvariant"))
+  #getSanitizedURLAttributeValue('form','action',$editorUrl, $fallbackUrl, $finalEditorUrl)
+<form id="backtoedit" class="buttons" action="$finalEditorUrl" method="post">
   <div>
     #foreach($param in $request.getParameterNames())
       #if(!$param.startsWith('action_'))
         #foreach($value in $request.getParameterValues($param))
           <input type="hidden" name="$!{escapetool.xml($param)}" value="$!{escapetool.xml($value)}"/>

Vulnerable code: <form id="backtoedit" class="buttons" action="$!{escapetool.xml($editorUrl)}" method="post">
Fixed code:   ## We use the wiki editor as fallback url since it's the one supposed to work in all conditions.
  #set ($fallbackUrl = $tdoc.getURL("edit", "editor=wiki&amp;$docvariant"))
  #getSanitizedURLAttributeValue('form','action',$editorUrl, $fallbackUrl, $finalEditorUrl)
<form id="backtoedit" class="buttons" action="$finalEditorUrl" method="post">