CVE-2022-41937: Missing Authorization (CWE-862)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 8.1
Published: 2022-11-22T01:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml
Commit date: 2022-06-30 17:49:37 +0200
Commit message: XWIKI-19758: Better control in Filter application

Diff: diff --git a/xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml b/xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml
index 468e3a502add..0d1b33cbeedb 100644
--- a/xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml
+++ b/xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml
@@ -18,11 +18,11 @@
  * License along with this software; if not, write to the Free
  * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 -->
 
-<xwikidoc version="1.3" reference="Filter.WebHome" locale="">
+<xwikidoc version="1.5" reference="Filter.WebHome" locale="">
   <web>Filter</web>
   <name>WebHome</name>
   <language/>
   <defaultLanguage/>
   <translation>0</translation>
@@ -34,13 +34,11 @@
   <title>Filter streams</title>
   <comment/>
   <minorEdit>false</minorEdit>
   <syntaxId>xwiki/2.1</syntaxId>
   <hidden>true</hidden>
-  <content>{{warning}}Filter module is still young and experimental and while exporting should be safe enough, importing can be more risky for the current instance.{{/warning}}
-
-{{include reference="FilterStreamDescriptorForm"/}}
+  <content>{{include reference="FilterStreamDescriptorForm"/}}
 
 {{velocity output="true"}}
 #set($input = $request.input)
 #set($output = $request.output)
 
@@ -75,10 +73,11 @@
 #end
 {{/velocity}}
 
 {{velocity}}
 #if ($request.convert)
+  #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
   #if ($targetStandardOutput)
     $response.setContentType('application/octet-stream')
     $response.setHeader('Content-Disposition', 'attachment; filename=target');
     $services.filter.convert($input, $inputProperties, $output, $outputProperties)
     $xcontext.setFinished(true)
@@ -105,10 +104,13 @@
           {{/html}}
         {{/error}}
       #end
     #end
   #end
+  #else
+    {{error}}You are not allowed to start a conversion.{{/error}}
+  #end
 #end
 {{/velocity}}
 
 == Current conversion
 
@@ -165,11 +167,15 @@
       #end
     &lt;/dl&gt;
   &lt;/fieldset&gt;
 
   &lt;p&gt;
-  &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;
+    #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
+      &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;
+    #else
+      &lt;input class="button" type="submit" name="convert" value="Convert" disabled title="You are not allowed to start a conversion."/&gt;
+    #end
   &lt;/p&gt;
 &lt;/div&gt;
 &lt;/form&gt;
 {{/html}}
 {{/velocity}}</content>
@@ -187,12 +193,15 @@
       <defaultWeb/>
       <nameField/>
       <validationScript/>
       <cache>
         <cache>0</cache>
+        <defaultValue>long</defaultValue>
         <disabled>0</disabled>
         <displayType>select</displayType>
+        <freeText>forbidden</freeText>
+        <largeStorage>0</largeStorage>
         <multiSelect>0</multiSelect>
         <name>cache</name>
         <number>5</number>
         <prettyName>Caching policy</prettyName>
         <relationalStorage>0</relationalStorage>
@@ -236,10 +245,12 @@
       </parse>
       <use>
         <cache>0</cache>
         <disabled>0</disabled>
         <displayType>select</displayType>
+        <freeText>forbidden</freeText>
+        <largeStorage>0</largeStorage>
         <multiSelect>0</multiSelect>
         <name>use</name>
         <number>3</number>
         <prettyName>Use this extension</prettyName>
         <relationalStorage>0</relationalStorage>

Vulnerable code: <xwikidoc version="1.3" reference="Filter.WebHome" locale="">
  <content>{{warning}}Filter module is still young and experimental and while exporting should be safe enough, importing can be more risky for the current instance.{{/warning}}

{{include reference="FilterStreamDescriptorForm"/}}
  &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;
Fixed code: <xwikidoc version="1.5" reference="Filter.WebHome" locale="">
  <content>{{include reference="FilterStreamDescriptorForm"/}}
  #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
  #else
    {{error}}You are not allowed to start a conversion.{{/error}}
  #end
    #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
      &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;
    #else
      &lt;input class="button" type="submit" name="convert" value="Convert" disabled title="You are not allowed to start a conversion."/&gt;
    #end
        <defaultValue>long</defaultValue>
        <freeText>forbidden</freeText>
        <largeStorage>0</largeStorage>
        <freeText>forbidden</freeText>
        <largeStorage>0</largeStorage>