CVE-2024-47920: Tiki Wiki CMS XSS Vulnerability

CVE-2024-47920 Overview

CVE-2024-47920 is a Cross-Site Scripting (XSS) vulnerability affecting Tiki Wiki CMS. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Tiki Wiki CMS fails to properly sanitize user-supplied input before reflecting it into rendered web pages. Attackers can inject arbitrary JavaScript that executes in the context of a victim's browser session.

The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation impacts confidentiality by allowing session token theft, credential harvesting, and unauthorized actions on behalf of the victim.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking, credential theft, and impersonation of authenticated Tiki Wiki users.

Affected Products

Tiki Wiki CMS Groupware
Web applications relying on vulnerable Tiki Wiki CMS instances
Tiki Wiki deployments exposing user-controllable input fields

Discovery Timeline

2024-12-30 - CVE-2024-47920 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-47920

Vulnerability Analysis

The vulnerability resides in how Tiki Wiki CMS processes input destined for web page generation. The application fails to neutralize special characters and script-bearing payloads before reflecting input into HTTP responses. This allows an attacker to embed JavaScript that the victim's browser then parses and executes.

The attack surface is reachable over the network without prior authentication or user interaction beyond standard browsing. An attacker crafts a URL or input payload that, when rendered, breaks out of expected HTML or attribute contexts. The injected script then runs under the origin of the Tiki Wiki application.

The EPSS model assigns this issue a probability of 0.496% and a percentile of 38.62, indicating moderate exploitation likelihood relative to other public CVEs.

Root Cause

The root cause is improper output encoding and missing input neutralization within Tiki Wiki's web page generation logic. Untrusted data flows into HTML, attribute, or script contexts without context-aware escaping. The application treats attacker-supplied content as trusted markup rather than inert text.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker delivers a crafted link, form submission, or stored payload to a Tiki Wiki instance. When the application renders the input, the browser interprets the embedded JavaScript. Reflected XSS variants require the victim to load an attacker-supplied URL, while stored variants persist server-side and trigger for any visitor.

No verified public proof-of-concept code is available for this advisory. See the Israeli Government CVE Advisories for additional context.

Detection Methods for CVE-2024-47920

Indicators of Compromise

HTTP request parameters containing <script>, javascript:, onerror=, or onload= payload patterns targeting Tiki Wiki endpoints
Web server access logs showing URL-encoded script fragments such as %3Cscript%3E directed at Tiki Wiki pages
Unexpected outbound browser requests to attacker-controlled domains originating from authenticated Tiki Wiki sessions
Anomalous session token reuse from geographically distinct IP addresses shortly after a user visits a Tiki Wiki link

Detection Strategies

Deploy web application firewall (WAF) rules to inspect query strings, POST bodies, and headers for XSS signature patterns targeting Tiki Wiki routes
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts
Correlate web server logs with endpoint telemetry to identify users redirected from suspicious Tiki Wiki URLs

Monitoring Recommendations

Continuously monitor Tiki Wiki application logs for input fields containing HTML tags or event handlers
Alert on administrative account activity originating from new user agents or IP addresses following XSS payload delivery
Track CSP report endpoints for spikes in script-src violations across Tiki Wiki hosts

How to Mitigate CVE-2024-47920

Immediate Actions Required

Upgrade Tiki Wiki CMS to the latest vendor-supplied release that addresses CVE-2024-47920
Audit Tiki Wiki user accounts for suspicious activity that may indicate session hijacking
Force password resets and invalidate active sessions for administrative users following patching
Review existing wiki content for stored XSS payloads injected prior to remediation

Patch Information

Apply the security update published by the Tiki Wiki project. Consult the Israeli Government CVE Advisories for advisory details and reference vendor release notes for the fixed version.

Workarounds

Deploy a WAF with XSS signature enforcement in front of Tiki Wiki instances until patching is complete
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Restrict anonymous edit and comment privileges on Tiki Wiki pages to reduce stored XSS exposure
Enable the HttpOnly and Secure flags on session cookies to limit script-based session theft

bash

# Example restrictive CSP header for Tiki Wiki responses
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";