CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
43.0%
A stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user’s credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled.
ChooseParentView
), available when managing pages via ModelAdmin.InspectView
) when displaying document fields.Patched versions have been released as Wagtail 4.1.4 (for the LTS 4.1 branch) and Wagtail 4.2.2 (for the current 4.2 branch).
Site owners who are unable to upgrade to the new versions can disable or override the corresponding functionality.
ChooseParentView
For ChooseParentView
:
choose_parent_view_class
, with the custom view overriding the get_form
method.One of those steps need to be applied for every ModelAdmin
class hooked into Wagtail where the model is a Wagtail Page
or sub-class. Here is an example of implementing the custom ChooseParentView
with patched HTML escaping:
from django import forms
from django.utils.translation import gettext as _
from wagtail.contrib.modeladmin.views import ChooseParentView
from wagtail.contrib.modeladmin.forms import ParentChooserForm
class PatchedPageChoiceField(forms.ModelChoiceField):
"""PageChoiceField with plain-text breadcrumbs to patch stored XSS."""
def label_from_instance(self, obj):
bits = []
for ancestor in (
obj.get_ancestors(inclusive=True).exclude(depth=1).specific(defer=True)
):
bits.append(ancestor.get_admin_display_title())
return ' | '.join(bits)
class PatchedParentChooserForm(ParentChooserForm):
"""ParentChooserForm with custom parent_page to patch stored XSS."""
parent_page = PatchedPageChoiceField(
label=_("Parent page"),
required=True,
empty_label=None,
queryset=Page.objects.none(),
widget=forms.RadioSelect(),
)
class PatchedChooseParentView(ChooseParentView):
"""ChooseParentView with custom get_form patch stored XSS."""
def get_form(self, request):
parents = self.permission_helper.get_valid_parent_pages(request.user)
return PatchedParentChooserForm(parents, request.POST or None)
InspectView
For InspectView
:
inspect_view_enabled=True
or set it to False to disable the view.inspect_view_fields
or inspect_view_fields_exclude
to prevent displaying document fields in the views.inspect_view_class
, with the custom view overriding the get_document_field_display
method.One of those steps need to be applied for every ModelAdmin
class hooked into Wagtail where inspect_view_enabled=True
. Here is an example of implementing the custom InspectView
with patched HTML escaping:
from django.template.defaultfilters import filesizeformat
from django.utils.html import format_html
from wagtail.contrib.modeladmin.views import InspectView
class PatchedInspectView(InspectView):
"""InspectView with override to patch stored XSS vulnerability."""
def get_document_field_display(self, field_name, field):
"""Render a link to a document"""
document = getattr(self.instance, field_name)
if document:
return format_html(
'<a href>{} <span>({}, {})</span></a>',
document.url,
document.title,
document.file_extension.upper(),
filesizeformat(document.file.size),
)
return self.model_admin.get_empty_value_display(field_name)
docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview
docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview
github.com/wagtail/wagtail
github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62
github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713
github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af
github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91
github.com/wagtail/wagtail/releases/tag/v4.1.4
github.com/wagtail/wagtail/releases/tag/v4.2.2
github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2
nvd.nist.gov/vuln/detail/CVE-2023-28836