| Impact
The SVG Macro (macro-svg) is vulnerable to Stored Cross-Site Scripting (XSS). The macro renders user-supplied content directly inside a hidden HTML <textarea> element without proper escaping. An attacker with edit rights (including low-privileged users) can inject a malicious payload that closes the <textarea> tag and executes arbitrary JavaScript code. This code executes in the browser of any user visiting the page, potentially leading to session hijacking or privilege escalation (if an administrator views the page). Technical Analysis
Vulnerable Component: xwiki-contrib/macro-svg File: src/main/resources/XWiki/SVGMacro.xml Root Cause: The macro content ($xcontext.macro.content) is injected directly into the DOM structure:
<textarea id="svg-${divid}-content" class="svg-content" style="display: none">
$content
</textarea>
The application fails to escape HTML tags within $content, specifically allowing the injection of </textarea>, which breaks out of the intended context. Proof of Concept
1. Create or edit a Wiki page using the Wiki Editor (Source mode) and insert the following payload:
{{svg}}
</textarea><script>alert('XSS in SVGMacro! Session hijacked: ' + document.cookie)</script><textarea>
{{/svg}}
2. Save and View the page.
The browser parses the HTML linearly. It encounters the closing </textarea> tag provided in the payload, closes the hidden text area immediately, and treats the subsequent <script> tag as executable code. Upon visiting the page, the JavaScript payload executes immediately.
 
Patches
The content injected into the <textarea> must be properly escaped using an HTML escaper to convert special characters (like < and >) into HTML entities.
Suggested Fix: Change: $content To: $escapetool.html($content) Attribution
Reported by: Łukasz Rybak GitHub: https://github.com/lukasz-rybak |
