XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that were sent in the original request to ensure that images with restricted view right can be compared. Starting in version 11.10.1 and prior to versions 14.10.15, 15.5.1, and 15.6, this allows an attacker to steal login and session cookies that allow impersonating the current user who views the diff. The attack can be triggered with an image that references the rendered diff, thus making it easy to trigger. Apart from stealing login cookies, this also allows server-side request forgery (the result of any successful request is returned in the image's source) and viewing protected content as once a resource is cached, it is returned for all users. As only successful requests are cached, the cache will be filled by the first user who is allowed to access the resource. This has been patched in XWiki 14.10.15, 15.5.1 and 15.6. The rendered diff now only downloads images from trusted domains. Further, cookies are only sent when the image's domain is the same the requested domain. The cache has been changed to be specific for each user. As a workaround, the image embedding feature can be disabled by deleting `xwiki-platform-diff-xml-<version>.jar` in `WEB-INF/lib/`.
During the rendering of differences (rendered diff), XWiki fetches embedded images on the server side to enable their comparison. During these requests, all cookies from the user's original request are transmitted, including session and login cookies. An attacker can embed an image on a wiki page pointing to a server under their control or to the rendered diff mechanism itself, which automatically triggers the transmission of the victim's cookies to an external host. Additionally, the results of successful requests are cached in a manner shared between users, enabling the display of content protected by other users.
An attacker can steal session and login cookies of the user viewing the diff, allowing complete account takeover. It is also possible to conduct SSRF attacks (the result of the request is returned as an image source) and gain access to protected resources through a shared cache.
XWiki Platform should be updated to version 14.10.15, 15.5.1, or 15.6, in which rendered diff fetches images only from trusted domains, cookies are sent only when the image domain is identical to the request domain, and cache is isolated per user. As a workaround, the image embedding feature can be disabled by removing the file `xwiki-platform-diff-xml-<version>.jar` from the `WEB-INF/lib/` directory.
XWiki Platform in versions from 11.10.1 to 14.10.14 (before 14.10.15), from 15.0 to 15.5.0 (before 15.5.1), and before version 15.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HXwiki
APPXwiki15.611.10.1 – 14.10.15 (excl.)15.0 – 15.5.1 (excl.)
Related vulnerabilities
XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch
XWiki Platform — path traversal umożliwia odczyt plików konfiguracyjnych
XWiki Platform: ujawnienie plików konfiguracyjnych przez webjars API (path traversal)
SQL Injection w XWiki Platform via parametr sort w getdeleteddocuments.vm
XWiki Rendering: bypass trybu restricted przez zagnieżdżone makra