CVE-2022-36093: Improper Authentication (CWE-287)
value: XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. Users can also be created when an external authentication system like LDAP is configured, but authentication fails unless the authentication system supports a bypass/local accounts are enabled in addition to the external authentication system. This issue has been patched in XWiki 13.10.5 and 14.3RC1. As a workaround, one may replace `xpart.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.1
Published: 2022-09-08T18:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/xpart.vm, xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/XPartPageTest.java
Commit date: 2022-03-31 16:32:15 +0200
Commit message: XWIKI-19558: Only load vm templates in xpart.vm

* Add a page test for xpart.vm.

Diff: diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/xpart.vm b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/xpart.vm
index 44b3d1b8f967..a244fc6d450c 100644
--- a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/xpart.vm
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/xpart.vm
@@ -20,6 +20,11 @@
 #set ($vm = $request.vm)
 #template('xwikivars.vm')
 #if ($request.useLayoutVars == 'true')
 #template('layoutvars.vm')
 #end
-#template($vm)
\ No newline at end of file
+#if ($vm.endsWith('.vm'))
+#template($vm)
+#else
+#set ($discard = $response.setStatus(400))
+Invalid template.
+#end
\ No newline at end of file
diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/XPartPageTest.java b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/XPartPageTest.java
new file mode 100644
index 000000000000..824b91db6f0b
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/XPartPageTest.java
@@ -0,0 +1,67 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.web;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xwiki.template.TemplateManager;
+import org.xwiki.test.page.PageTest;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Tests the {@code xpart.vm} template.
+ *
+ * @version $Id$
+ * @since 14.3RC1
+ * @since 13.10.5
+ */
+class XPartPageTest extends PageTest
+{
+    private static final String X_PART_VM = "xpart.vm";
+
+    private static final String VM_PARAMETER = "vm";
+
+    private TemplateManager templateManager;
+
+    @BeforeEach
+    void setUp() throws Exception
+    {
+        this.templateManager = this.componentManager.getInstance(TemplateManager.class);
+        this.request.put("xpage", "xpart");
+    }
+
+    @Test
+    void renderRegisterTemplate() throws Exception
+    {
+        this.request.put(VM_PARAMETER, "register.vm");
+        String result = this.templateManager.render(X_PART_VM);
+        assertTrue(result.contains("<form id=\"register\""));
+    }
+
+    @Test
+    void renderForbiddenTemplate() throws Exception
+    {
+        this.request.put(VM_PARAMETER, "distribution/firstadminuser.wiki");
+        String result = this.templateManager.render(X_PART_VM);
+        assertEquals("Invalid template.", result.trim());
+    }
+}

Vulnerable code: #template($vm)
Fixed code: #if ($vm.endsWith('.vm'))
#template($vm)
#else
#set ($discard = $response.setStatus(400))
Invalid template.
#end
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.web;

import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.xwiki.template.TemplateManager;
import org.xwiki.test.page.PageTest;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;

/**
 * Tests the {@code xpart.vm} template.
 *
 * @version $Id$
 * @since 14.3RC1
 * @since 13.10.5
 */
class XPartPageTest extends PageTest
{
    private static final String X_PART_VM = "xpart.vm";

    private static final String VM_PARAMETER = "vm";

    private TemplateManager templateManager;

    @BeforeEach
    void setUp() throws Exception
    {
        this.templateManager = this.componentManager.getInstance(TemplateManager.class);
        this.request.put("xpage", "xpart");
    }

    @Test
    void renderRegisterTemplate() throws Exception
    {
        this.request.put(VM_PARAMETER, "register.vm");
        String result = this.templateManager.render(X_PART_VM);
        assertTrue(result.contains("<form id=\"register\""));
    }

    @Test
    void renderForbiddenTemplate() throws Exception
    {
        this.request.put(VM_PARAMETER, "distribution/firstadminuser.wiki");
        String result = this.templateManager.render(X_PART_VM);
        assertEquals("Invalid template.", result.trim());
    }
}