# CVE-2022-24948: Apache JSPWiki preauth Stored XSS to ATO

Preauth stored XSS in JSPWiki username field via single-quote attribute escape, chained with CSRF to change victim username and achieve account takeover.

- Payout: Research
- Severity: high
- Program: Apache JSPWiki
- Credited: PWNAI Research
- Disclosed: 2022-03-02
- CVE: CVE-2022-24948, CVE-2022-24947
- Write-up quality: 8/10
- Original: https://pwn.ai/blog/apache-jspwiki-preauth-xss-to-ato
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-apache-jspwiki-preauth-xss-to-ato
- Tags: domain:web impact:ato kind:research platform:research sev:high tech:java technique:chained vuln:account-takeover vuln:csrf vuln:open-redirect vuln:xss

**Target:** JSPWiki username field rendered into meta tag content attribute
**Root cause:** Username is interpolated into a single-quoted content attribute of a meta tag; single quotes are not escaped, allowing attribute breakout. Colon is banned but bypassed via existing CSS class for display:block.
**Steps:**
1. Set username to `1000' onfocus=alert(1) id=x tabindex=0 class="form-control"`
2. Rendered output: `<meta content='1000' onfocus=alert(1) id=x tabindex=0 class="form-control"/>`
3. Victim visits `https://JSPWIKI/?#x` to focus the id and trigger onfocus
4. For versions rendering into an anchor tag, use `10000;' onclick=alert(12) accesskey=x>`
5. Chain with CSRF (CVE-2022-24947) to set victim's username to payload, then load homepage to fire XSS
**How found:** Noticed username reflected into meta content attribute with single quotes; double quotes banned but single quote breakout possible. Colon banned blocked javascript: scheme and meta javascript redirects are null-origin, so pivoted to onfocus+id+tabindex trick; needed display:block without colon, found existing CSS class `form-control` in haddock.css providing it.
**Exploitation:** Attacker hosts malicious page that CSRF-changes victim's username to XSS payload, then redirects victim to homepage with #x fragment to trigger onfocus. XSS then changes victim's email to attacker's, attacker triggers password reset and receives token to take over account.
**Escalation:** XSS chained with CSRF for preauth delivery, then email change + password reset for full account takeover.
**Insight:** When a colon filter blocks inline styles, hunt the site's own CSS for a class that supplies the needed property (e.g. display:block) so you can drop the colon entirely; also meta tags can fire onfocus via id + #fragment.