Stored XSS in YesWiki via Filtertags Action Parameter

Executive Summary

YesWiki before version 4.7.0 has a stored cross-site scripting (XSS) vulnerability in the filtertags action. Attackers can inject malicious scripts via action-attribute parameters that bypass the raw-HTML protection. The injected JavaScript executes for every user viewing the affected page, enabling actions like session theft or page defacement.

Useful 0 Not Useful 0

Detection Guidance

Check YesWiki version with: grep -r "YesWiki" /path/to/yeswiki/ | grep version. Look for modified filtertags.php in tools/tags/actions/. Test by creating a page with action parameters like {{filtertags action="test" title="<script>alert(1)</script>"}} and check if script executes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of other users' browsers. Potential impacts include session hijacking, theft of sensitive data, unauthorized actions on behalf of users, or complete page defacement. Any user viewing a compromised page could be affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations for data security and user consent.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade YesWiki to version 4.7.0 or later immediately. If upgrading is not possible, apply the patch to output-encode $tagname, $param['title'], and tagbadges in tools/tags/actions/filtertags.php. Restrict anonymous user page creation and editing permissions.

Useful 0 Not Useful 0