CVE-2022-41927 (XML, published 2022-11-23T19:15Z)
Description: value: XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```
Severity: nan (CVSS v3 base score: 7.4)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-tag/xwiki-platform-tag-ui/src/main/resources/Main/Tags.xml
Commit message: XWIKI-19748: Wrong error code in tags

  * Fix the error code when manipulating tags


Vulnerable code:
  ##
  ## Rename tag
  ##
  #set ($renameTo = "$!{request.get('renameTo')}")
  #set ($success = false)
  #if ($renameTo != '')
    #set ($success = $xwiki.tag.renameTag($tag, $renameTo))
  #end
  #if ($success == true || $success == 'OK')
   #set ($urlEscapedRenameTo = $escapetool.url($renameTo))
   $response.sendRedirect($doc.getURL('view', "do=viewTag&amp;tag=${urlEscapedRenameTo}&amp;renamedTag=${urlEscapedTag}"))
    {{error}}$services.localization.render('xe.tag.rename.failure', ["//${wikiEscapedTag}//", "//${services.rendering.escape($renameTo, 'xwiki/2.1')}//"]){{/error}}
  ##
  ## Delete tag
  ##
  #set ($success = $xwiki.tag.deleteTag($tag))
  #if ($success == true || $success == 'OK')
    $response.sendRedirect($doc.getURL('view', "deletedTag=${urlEscapedTag}"))
    {{error}}$services.localization.render('xe.tag.delete.failure', ["//${wikiEscapedTag}//"]){{/error}}

Fixed code:
  #if (!$services.csrf.isTokenValid($request.get('form_token')))
    #set ($discard = $response.sendError(401, "Wrong CSRF token"))
    ##
    ## Rename tag
    ##
    #set ($renameTo = "$!{request.get('renameTo')}")
    #set ($success = false)
    #if ($renameTo != '')
      #set ($success = $xwiki.tag.renameTag($tag, $renameTo))
    #end
    #if ($success == true || $success == 'OK')
     #set ($urlEscapedRenameTo = $escapetool.url($renameTo))
     $response.sendRedirect($doc.getURL('view', "do=viewTag&amp;tag=${urlEscapedRenameTo}&amp;renamedTag=${urlEscapedTag}"))
    #else
      {{error}}$services.localization.render('xe.tag.rename.failure', ["//${wikiEscapedTag}//", "//${services.rendering.escape($renameTo, 'xwiki/2.1')}//"]){{/error}}
    #end
  #if (!$services.csrf.isTokenValid($request.get('form_token')))
    #set ($discard = $response.sendError(401, "Wrong CSRF token"))
    ##
    ## Delete tag
    ##
    #set ($success = $xwiki.tag.deleteTag($tag))
    #if ($success == true || $success == 'OK')
      $response.sendRedirect($doc.getURL('view', "deletedTag=${urlEscapedTag}"))
    #else
      {{error}}$services.localization.render('xe.tag.delete.failure', ["//${wikiEscapedTag}//"]){{/error}}
    #end