CVE-2019-12407

Vulnerability

Overview

CVE-2019-12407 is a cross-site scripting (XSS) vulnerability in Apache JSPWiki, affecting versions up to 2.11.0.M4. The flaw arises due to insufficient sanitization of the 'remember' parameter in certain JSP pages. An attacker can craft a malicious plugin link invocation that, when opened by a victim, injects arbitrary JavaScript into the rendering context[1][3].

Exploitation

Vector

The attack requires the victim to interact with a specially crafted link, typically delivered via email, another website, or directly within the wiki. No authentication is needed to deliver the malicious payload; however, the victim must click the link while logged into the wiki to maximize the potential for data access. The XSS executes in the browser session's context[1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can be leveraged to steal session cookies, capture form data, or perform other malicious actions on behalf of the victim within the JSPWiki application, leading to information disclosure and potential account compromise[1][3].

Mitigation

Apache JSPWiki users should upgrade to version 2.11.0.M5 or later, which contains a fix for this issue. No workarounds have been published. The vulnerability was discovered by ADLab of VenusTech[3].