Server-Side Request Forgery (SSRF) in XWiki platform - CVE-2023-48240

Description

The vulnerability allows a remote user to steal login and session cookies, perform server-side request forgery, and disclose protected content.

The vulnerability exists due to insertion of sensitive information into sent data and improper request destination restriction in rendered diff image fetching when processing rendered diffs with embedded external images. A remote user can embed or reference a crafted rendered diff so that the server requests attacker-controlled or protected resources to steal login and session cookies, perform server-side request forgery, and disclose protected content.

User interaction is required to view the diff or an image that references the rendered diff, and cached successful requests can be returned for other users.

Remediation

External links

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7rfg-6273-f5wp
• https://github.com/xwiki/xwiki-platform/commit/bff0203e739b6e3eb90af5736f04278c73c2a8bb