CVE-2022-23617: Missing Authorization (CWE-862)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.5
Published: 2022-02-09T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java, xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java
Commit date: 2021-03-15 12:11:24 +0100
Commit message: XWIKI-18430: Wrong handling of template documents
* improve retro compatibility with future 12.10.x versions

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java
index 38f65bfba0f..e735ebdab84 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java
@@ -30,11 +30,10 @@
 
 import org.apache.commons.lang3.StringUtils;
 import org.xwiki.component.annotation.Component;
 import org.xwiki.csrf.CSRFToken;
 import org.xwiki.model.reference.DocumentReference;
-import org.xwiki.model.reference.DocumentReferenceResolver;
 import org.xwiki.model.reference.EntityReferenceSerializer;
 import org.xwiki.model.reference.SpaceReference;
 import org.xwiki.security.authorization.ContextualAuthorizationManager;
 import org.xwiki.security.authorization.Right;
 
@@ -95,15 +94,10 @@ public class CreateAction extends XWikiAction
     /**
      * Local entity reference serializer hint.
      */
     private static final String LOCAL_SERIALIZER_HINT = "local";
 
-    /**
-     * Current entity reference resolver hint.
-     */
-    private static final String CURRENT_MIXED_RESOLVER_HINT = "currentmixed";
-
     /**
      * The action to perform when creating a new page from a template.
      *
      * @version $Id$
      */
@@ -275,18 +269,10 @@ private void doCreate(XWikiContext context, XWikiDocument newDocument, boolean i
             // Perform the redirect
             sendRedirect(context.getResponse(), redirectURL);
         }
     }
 
-    /**
-     * @return the resolver uses to resolve references received in request parameters
-     */
-    private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
-    {
-        return Utils.getComponent(DocumentReferenceResolver.TYPE_STRING, CURRENT_MIXED_RESOLVER_HINT);
-    }
-
     /**
      * Initialize and save the new document before editing it. Follow the steps done by the Save action.
      * 
      * @param context the XWiki context
      * @param newDocument the document being created
@@ -310,11 +296,11 @@ private void initAndSaveDocument(XWikiContext context, XWikiDocument newDocument
         // Copy the template.
         readFromTemplate(newDocument, template, context);
 
         // Set the parent field.
         if (!StringUtils.isEmpty(parent)) {
-            DocumentReference parentReference = this.currentmixedReferenceResolver.resolve(parent);
+            DocumentReference parentReference = getCurrentMixedDocumentReferenceResolver().resolve(parent);
             newDocument.setParentReference(parentReference);
         }
 
         // Set the document title
         if (title != null) {
diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java
index 538f6d58059..c1088e9bdbb 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java
@@ -151,27 +151,27 @@ public abstract class XWikiAction implements LegacyAction
     protected Container container;
 
     @Inject
     protected Execution execution;
 
-    @Inject
-    protected ContextualAuthorizationManager autorization;
-
-    @Inject
-    @Named("currentmixed")
-    protected DocumentReferenceResolver<String> currentmixedReferenceResolver;
-
     /**
      * Indicate if the action allow asynchronous display (among which the XWiki initialization).
      */
     protected boolean waitForXWikiInitialization = true;
 
     /**
      * Indicate if the XWiki.RedirectClass is handled by the action (see handleRedirectObject()).
      */
     protected boolean handleRedirectObject = false;
 
+    @Inject
+    @Named("currentmixed")
+    private DocumentReferenceResolver<String> currentmixedReferenceResolver;
+
+    @Inject
+    private ContextualAuthorizationManager autorization;
+
     private ContextualLocalizationManager localization;
 
     private JobProgressManager progress;
 
     private ScriptContextManager scriptContextManager;
@@ -199,10 +199,28 @@ protected ContextualLocalizationManager getLocalization()
         }
 
         return this.localization;
     }
 
+    /**
+     * @since 12.10.6
+     * @since 13.2RC1
+     */
+    protected DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
+    {
+        return this.currentmixedReferenceResolver;
+    }
+
+    /**
+     * @since 12.10.6
+     * @since 13.2RC1
+     */
+    protected ContextualAuthorizationManager getContextualAuthorizationManager()
+    {
+        return this.autorization;
+    }
+
     protected String localizePlainOrKey(String key, Object... parameters)
     {
         return StringUtils.defaultString(getLocalization().getTranslationPlain(key, parameters), key);
     }
 
@@ -1156,14 +1174,14 @@ protected void setContentLength(XWikiResponse response, long length)
      * @since 13.2RC1
      */
     protected DocumentReference resolveTemplate(String template)
     {
         if (StringUtils.isNotBlank(template)) {
-            DocumentReference templateReference = this.currentmixedReferenceResolver.resolve(template);
+            DocumentReference templateReference = getCurrentMixedDocumentReferenceResolver().resolve(template);
 
             // Make sure the current user have access to the template document before copying it
-            if (this.autorization.hasAccess(Right.VIEW, templateReference)) {
+            if (getContextualAuthorizationManager().hasAccess(Right.VIEW, templateReference)) {
                 return templateReference;
             }
         }
 
         return null;

Vulnerable code: import org.xwiki.model.reference.DocumentReferenceResolver;
    /**
     * Current entity reference resolver hint.
     */
    private static final String CURRENT_MIXED_RESOLVER_HINT = "currentmixed";

    /**
     * @return the resolver uses to resolve references received in request parameters
     */
    private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
    {
        return Utils.getComponent(DocumentReferenceResolver.TYPE_STRING, CURRENT_MIXED_RESOLVER_HINT);
    }

            DocumentReference parentReference = this.currentmixedReferenceResolver.resolve(parent);
    @Inject
    protected ContextualAuthorizationManager autorization;

    @Inject
    @Named("currentmixed")
    protected DocumentReferenceResolver<String> currentmixedReferenceResolver;

            DocumentReference templateReference = this.currentmixedReferenceResolver.resolve(template);
            if (this.autorization.hasAccess(Right.VIEW, templateReference)) {
Fixed code:             DocumentReference parentReference = getCurrentMixedDocumentReferenceResolver().resolve(parent);
    @Inject
    @Named("currentmixed")
    private DocumentReferenceResolver<String> currentmixedReferenceResolver;

    @Inject
    private ContextualAuthorizationManager autorization;

    /**
     * @since 12.10.6
     * @since 13.2RC1
     */
    protected DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
    {
        return this.currentmixedReferenceResolver;
    }

    /**
     * @since 12.10.6
     * @since 13.2RC1
     */
    protected ContextualAuthorizationManager getContextualAuthorizationManager()
    {
        return this.autorization;
    }

            DocumentReference templateReference = getCurrentMixedDocumentReferenceResolver().resolve(template);
            if (getContextualAuthorizationManager().hasAccess(Right.VIEW, templateReference)) {