CVE-2024-47918: Tiki Wiki CMS XSS Vulnerability

CVE-2024-47918 Overview

CVE-2024-47918 is a Cross-Site Scripting (XSS) vulnerability affecting Tiki Wiki CMS. The flaw stems from improper neutralization of script-related HTML tags in a web page, classified under [CWE-80] Basic XSS. The vulnerability requires user interaction to trigger and can result in a scope change with limited impact on confidentiality and integrity.

An attacker can craft malicious input containing script-related HTML tags that Tiki Wiki CMS fails to properly sanitize. When rendered in a victim's browser, the injected content executes in the context of the vulnerable application.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script content in the victim's browser session, potentially leading to session token theft, defacement, or redirection to attacker-controlled resources.

Affected Products

Tiki Wiki CMS Groupware
Specific affected versions not enumerated in the NVD entry
Instances exposing user-controllable input rendered without proper HTML entity encoding

Discovery Timeline

2024-12-30 - CVE CVE-2024-47918 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47918

Vulnerability Analysis

The vulnerability is a Basic Cross-Site Scripting flaw in Tiki Wiki CMS. It occurs when the application fails to neutralize script-related HTML tags such as <script> before including user-controlled data in a web page. An attacker submits crafted input containing HTML or JavaScript payloads. When another user views the affected page, the browser interprets the payload as executable code.

Exploitation requires user interaction. A victim must visit a URL or view content that contains the attacker's payload. Because the vulnerability results in a scope change, the injected script can affect resources beyond the vulnerable component's security authority, such as other origins or browser-managed data.

The practical impact includes theft of session cookies, keystroke logging via injected event handlers, redirection to phishing pages, and unauthorized actions performed on behalf of the authenticated user.

Root Cause

The root cause is missing or incomplete output encoding of user-supplied data. Tiki Wiki CMS does not consistently apply HTML entity encoding or a strict sanitization allowlist before echoing content into rendered pages. Script-related tags pass through into the DOM and execute.

Attack Vector

The attack vector is network-based with low complexity. No privileges are required, but user interaction is necessary. An attacker delivers a link or embeds crafted content in a wiki page, comment, or form field. When the victim loads the page, the payload executes in the browser context.

Because verified proof-of-concept code is not published for this CVE, exploit details are described in prose. Refer to the Israeli Government CVE Advisories for additional context.

Detection Methods for CVE-2024-47918

Indicators of Compromise

Wiki content, comments, or form submissions containing <script>, onerror=, onload=, or javascript: payloads
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading Tiki Wiki CMS pages
Unexpected session terminations or account activity following visits to specific Tiki Wiki CMS URLs

Detection Strategies

Inspect HTTP request bodies and query parameters submitted to Tiki Wiki CMS endpoints for HTML tag patterns and JavaScript event handlers
Review stored wiki content and user-generated fields for embedded script fragments or encoded payload variants
Correlate web server access logs with Content Security Policy (CSP) violation reports to identify injection attempts

Monitoring Recommendations

Enable and monitor CSP report-only mode to capture inline script execution attempts
Log all POST requests to Tiki Wiki CMS content submission endpoints with full request bodies for retrospective analysis
Alert on authenticated user sessions performing unusual DOM interactions or rapid outbound requests after page load

How to Mitigate CVE-2024-47918

Immediate Actions Required

Upgrade Tiki Wiki CMS to the latest patched release published by the vendor
Audit existing wiki content and user-submitted fields for stored XSS payloads and remove malicious entries
Rotate session credentials for administrative and privileged accounts that may have been exposed

Patch Information

Consult the Tiki Wiki CMS project release notes and the Israeli Government CVE Advisories for the vendor-supplied fix. Apply the patched version to all instances and verify the fix in staging before production deployment.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Place a web application firewall (WAF) in front of Tiki Wiki CMS with rules that filter script tags and event handler attributes in request parameters
Restrict content submission privileges to trusted users until the patch is applied

bash

# Example CSP header restricting inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'