CVE-2011-2510

Vulnerability

The RSS embedding feature in DokuWiki versions prior to the 2011-05-25a Rincewind hotfix release does not properly escape user-provided links. An attacker can inject arbitrary web script or HTML through a malicious link embedded in an RSS feed. This affects at least Anteater and Rincewind releases, and likely older versions as well [3].

Exploitation

An attacker needs to craft a link containing malicious JavaScript and have it included in an RSS feed that is embedded in a DokuWiki page. The attacker does not require authentication if they can control the RSS feed content (e.g., by hosting a malicious feed or exploiting another vulnerability to inject a link). When a user views the page with the embedded RSS feed, the injected script executes in the context of the victim's session.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a user viewing the affected DokuWiki page. This can lead to session hijacking, defacement, or theft of sensitive information. The attack is a classic cross-site scripting (XSS) vulnerability [1][2].

Mitigation

The vulnerability is fixed in DokuWiki release 2011-05-25a Rincewind, released on June 14, 2011 [3]. Users should upgrade to this version or later. For those unable to upgrade, the hotfix announcement provides instructions to manually replace specific files (inc/parser/xhtml.php, inc/mail.php, inc/indexer.php, VERSION, doku.php) with patched versions from the GitHub repository [3]. No workaround is available other than applying the patch.