CVE-2022-23615: Incorrect Authorization (CWE-863)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.4
Published: 2022-02-09T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java, xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm
Commit date: 2021-01-19 09:28:28 +0100
Commit message: XWIKI-5024: Document potentially saved with the wrong author
* add an configuration off switch

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java
index 6b3dbff0c88..4dc15239a2d 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java
@@ -35,10 +35,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.suigeneris.jrcs.diff.DifferentiationFailedException;
 import org.suigeneris.jrcs.diff.delta.Delta;
 import org.suigeneris.jrcs.rcs.Version;
+import org.xwiki.configuration.ConfigurationSource;
 import org.xwiki.context.Execution;
 import org.xwiki.context.ExecutionContext;
 import org.xwiki.display.internal.DocumentDisplayerParameters;
 import org.xwiki.model.reference.DocumentReference;
 import org.xwiki.model.reference.DocumentReferenceResolver;
@@ -67,10 +68,11 @@
 import com.xpn.xwiki.doc.XWikiAttachment;
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.doc.XWikiDocumentArchive;
 import com.xpn.xwiki.doc.XWikiLink;
 import com.xpn.xwiki.doc.XWikiLock;
+import com.xpn.xwiki.internal.XWikiCfgConfigurationSource;
 import com.xpn.xwiki.objects.BaseObject;
 import com.xpn.xwiki.objects.BaseProperty;
 import com.xpn.xwiki.objects.ObjectDiff;
 import com.xpn.xwiki.objects.classes.BaseClass;
 import com.xpn.xwiki.plugin.fileupload.FileUploadPlugin;
@@ -130,10 +132,12 @@ public class Document extends Api
      */
     private EntityReferenceSerializer<String> compactWikiEntityReferenceSerializer;
 
     private DocumentRevisionProvider documentRevisionProvider;
 
+    private ConfigurationSource configuration;
+
     private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
     {
         if (this.currentMixedDocumentReferenceResolver == null) {
             this.currentMixedDocumentReferenceResolver =
                 Utils.getComponent(DocumentReferenceResolver.TYPE_STRING, "currentmixed");
@@ -177,10 +181,19 @@ private DocumentRevisionProvider getDocumentRevisionProvider()
         }
 
         return this.documentRevisionProvider;
     }
 
+    private ConfigurationSource getConfiguration()
+    {
+        if (this.configuration == null) {
+            this.configuration = Utils.getComponent(ConfigurationSource.class);
+        }
+
+        return this.configuration;
+    }
+
     /**
      * Document constructor.
      *
      * @param doc The XWikiDocument object to wrap.
      * @param context The current request context.
@@ -2535,11 +2548,11 @@ public void save(String comment) throws XWikiException
     public void save(String comment, boolean minorEdit) throws XWikiException
     {
         if (hasAccessLevel("edit")) {
             // If the current author does not have PR don't let it set current user as author of the saved document
             // since it can lead to right escalation
-            if (hasProgrammingRights()) {
+            if (hasProgrammingRights() || !getConfiguration().getProperty("security.script.save.checkAuthor", true)) {
                 saveDocument(comment, minorEdit);
             } else {
                 saveAsAuthor(comment, minorEdit);
             }
         } else {
diff --git a/xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm b/xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm
index 8d6d5a53b27..40c4ba5d8c3 100644
--- a/xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm
+++ b/xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm
@@ -662,10 +662,17 @@ extension.versioncheck.environment.enabled=$xwikiPropertiesEnvironmentVersionChe
 #-# The identifier provided here is matched with the component role hint.
 #-#
 #-# The default is:
 # security.authorization.settler=default
 
+#-# [Since 13.0]
+#-# Control if document save API should also check the right of the script author when saving a document.
+#-# When false only the current user right is checked.
+#-#
+#-# The default is:
+# security.script.save.checkAuthor=true
+
 #-------------------------------------------------------------------------------------
 # URL
 #-------------------------------------------------------------------------------------
 
 #-# IMPORTANT: The URL module is a feature still in development and as such should be considered experimental at the
@@ -1183,6 +1190,6 @@ edit.defaultEditor.org.xwiki.rendering.block.XDOM#wysiwyg=$xwikiPropertiesDefaul
 #-#   follow the ECMAScript strict rules. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode
 #-#
 #-# The default value is:
 # skinx.jsStrictModeEnabled = false
 
-$!xwikiPropertiesAdditionalProperties
\ No newline at end of file
+$!xwikiPropertiesAdditionalProperties

Vulnerable code:             if (hasProgrammingRights()) {
$!xwikiPropertiesAdditionalProperties
Fixed code: import org.xwiki.configuration.ConfigurationSource;
import com.xpn.xwiki.internal.XWikiCfgConfigurationSource;
    private ConfigurationSource configuration;

    private ConfigurationSource getConfiguration()
    {
        if (this.configuration == null) {
            this.configuration = Utils.getComponent(ConfigurationSource.class);
        }

        return this.configuration;
    }

            if (hasProgrammingRights() || !getConfiguration().getProperty("security.script.save.checkAuthor", true)) {
#-# [Since 13.0]
#-# Control if document save API should also check the right of the script author when saving a document.
#-# When false only the current user right is checked.
#-#
#-# The default is:
# security.script.save.checkAuthor=true

$!xwikiPropertiesAdditionalProperties