Critical, CVSS 9.0MavenPublished
Cookies are sent to external images in rendered diff (and server side request forgery)
CVE-2023-48240 · GHSA-7rfg-6273-f5wp
- Affected
- Maven org.xwiki.platform:xwiki-platform-diff-xml >= 11.10.1, < 14.10.15; >= 15.0-rc-1, < 15.5.1; >= 15.6-rc-1, < 15.6
- Fixed in
- 14.10.1515.615.5.1· Vendor fix available
- Issue
- Impact The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that were sent in the original request to ensure that images with restricted view right can be compared. This allows an attacker to steal login and session cookies that allow impersonating the current user who views the diff. The attack can be triggered with an image that references the rendered diff, thus making it easy to trigger. More concretely, to reproduce, add 101 different images with references to the attacker's server. In any place add an image with a reference to /xwiki/bin/view/Image%20Cookie%20Test/?xpage=changes&rev1=1.1&rev2=2.1&include=renderedChanges where Image%20Cookie%20Test needs to be replaced by the path to the document with the images and the two revisions should match the…
Recommended action: Upgrade to 15.6, 15.5.1 or 14.10.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.