CVE-2022-41927 (published 2022-11-23T19:15Z)

XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It\'s possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get(\'form_token\'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```

CVSS v3 base score: 7.4, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Simon Urli
author_date: 2022-06-02 12:02:58+02:00
msg: XWIKI-19748: Wrong error code in tags

  * Fix the error code when manipulating tags
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: Tags.xml
change_type: ModificationType.MODIFY
diff: @@ -112,19 +112,23 @@
   &lt;/form&gt;
 {{/html}}
 #elseif ($do == 'renameTag')
-  ##
-  ## Rename tag
-  ##
-  #set ($renameTo = "$!{request.get('renameTo')}")
-  #set ($success = false)
-  #if ($renameTo != '')
-    #set ($success = $xwiki.tag.renameTag($tag, $renameTo))
-  #end
-  #if ($success == true || $success == 'OK')
-   #set ($urlEscapedRenameTo = $escapetool.url($renameTo))
-   $response.sendRedirect($doc.getURL('view', "do=viewTag&amp;tag=${urlEscapedRenameTo}&amp;renamedTag=${urlEscapedTag}"))
+  #if (!$services.csrf.isTokenValid($request.get('form_token')))
+    #set ($discard = $response.sendError(401, "Wrong CSRF token"))
   #else
-    {{error}}$services.localization.render('xe.tag.rename.failure', ["//${wikiEscapedTag}//", "//${services.rendering.escape($renameTo, 'xwiki/2.1')}//"]){{/error}}
+    ##
+    ## Rename tag
+    ##
+    #set ($renameTo = "$!{request.get('renameTo')}")
+    #set ($success = false)
+    #if ($renameTo != '')
+      #set ($success = $xwiki.tag.renameTag($tag, $renameTo))
+    #end
+    #if ($success == true || $success == 'OK')
+     #set ($urlEscapedRenameTo = $escapetool.url($renameTo))
+     $response.sendRedirect($doc.getURL('view', "do=viewTag&amp;tag=${urlEscapedRenameTo}&amp;renamedTag=${urlEscapedTag}"))
+    #else
+      {{error}}$services.localization.render('xe.tag.rename.failure', ["//${wikiEscapedTag}//", "//${services.rendering.escape($renameTo, 'xwiki/2.1')}//"]){{/error}}
+    #end
   #end
 #elseif ($do == 'prepareDelete')
   ##
@@ -142,14 +146,18 @@
   &lt;/form&gt;
 {{/html}}
 #elseif ($do == 'deleteTag')
-  ##
-  ## Delete tag
-  ##
-  #set ($success = $xwiki.tag.deleteTag($tag))
-  #if ($success == true || $success == 'OK')
-    $response.sendRedirect($doc.getURL('view', "deletedTag=${urlEscapedTag}"))
+  #if (!$services.csrf.isTokenValid($request.get('form_token')))
+    #set ($discard = $response.sendError(401, "Wrong CSRF token"))
   #else
-    {{error}}$services.localization.render('xe.tag.delete.failure', ["//${wikiEscapedTag}//"]){{/error}}
+    ##
+    ## Delete tag
+    ##
+    #set ($success = $xwiki.tag.deleteTag($tag))
+    #if ($success == true || $success == 'OK')
+      $response.sendRedirect($doc.getURL('view', "deletedTag=${urlEscapedTag}"))
+    #else
+      {{error}}$services.localization.render('xe.tag.delete.failure', ["//${wikiEscapedTag}//"]){{/error}}
+    #end
   #end
 #else
   ##

programming_language: HTML