XSS vulnerability on Denounce plugin

Vulnerability

A carefully crafted plugin link invocation in Apache JSPWiki’s Denounce plugin triggers a Cross-Site Scripting (XSS) vulnerability [1][4]. The Denounce plugin dangerously renders user-supplied URLs without proper sanitization. This affects Apache JSPWiki up to version 2.11.0.M8 [4].

Exploitation

An attacker can craft a malicious plugin link that, when invoked by a victim, executes arbitrary JavaScript in the victim’s browser. No special privileges are required beyond the ability to create or inject a plugin link within a wiki page that the victim views [1][4]. The attacker does not need to be authenticated if the target wiki allows public editing or if the link can be delivered via other means (e.g., email).

Impact

Successful exploitation allows the attacker to execute JavaScript in the victim’s browser, enabling theft of sensitive information such as session tokens, credentials, or personal data [1][4]. The impact is limited to the victim’s browser session and the data accessible within the wiki application context.

Mitigation

Users should upgrade to Apache JSPWiki version 2.11.0 or later [1][4]. No known workarounds are documented. The vulnerability was publicly disclosed in November 2021. Later analysis (CVE-2022-28730) suggested the initial patch was incomplete, but that issue is tracked separately and requires upgrading to 2.11.3 or later [3].