Cloudanix VulnDB

CVE-2024-34481

Medium · 6.1

CVSS

6.1

EPSS

0.6%

Published

Jul 5, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Someone could add hidden code to wiki comments or picture descriptions that runs automatically when others read the page, potentially letting attackers access information or take actions as that reader.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Tampering
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The application fails to sanitize user-supplied content in wiki comments, image captions, and titles, allowing injection and execution of arbitrary client-side scripts in other users' browsers.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of wiki users, potentially damaging trust and exposing internal collaboration data.

How an attack unfolds

An attacker with wiki editing access crafts a payload containing script tags or event handlers in a comment or image title; when another user views the page the browser executes the script in the context of the site, enabling theft of cookies or other actions.

How to fix it

Upgrade kontextwork drupal wiki to version 8.31.1 or later; apply input sanitization and output encoding for all user-generated wiki content; review existing pages for injected scripts.

How to confirm the fix worked

Confirm the installed version is 8.31.1 or newer; test comment, caption, and title fields with known XSS test vectors to verify they are now escaped or blocked; review change logs for the applied fixes.

Typical attack path

  1. Identify a wiki page allowing comments or image uploads
  2. Insert unsanitized HTML or JavaScript payload into a comment, caption, or title field
  3. Save the page so the payload persists
  4. Wait for or lure a victim user to view the page
  5. Script executes in victim's browser and performs malicious actions such as cookie theft

How to detect it

Review web server and application logs for requests containing script tags or event handlers in comment or image parameters; inspect stored wiki content for unexpected HTML or JavaScript; check browser console reports or CSP violation logs for execution attempts.

What your security team should do

  • Apply the 8.31.1 update immediately across all instances
  • Audit existing wiki pages for suspicious scripts in comments and titles
  • Enable content security policy headers to limit script execution
  • Train wiki editors on safe content practices
  • Monitor for anomalous script execution in browser telemetry

The record

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:Pro:14.04:LTS drupal7 0 No fix
Ubuntu:Pro:16.04:LTS drupal7 0 No fix

Related vulnerabilities