CVE-2023-29521: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-04-19T00:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml, xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml
Commit date: 2022-12-16 11:56:31 +0100
Commit message: XWIKI-20260: Improved escaping of VFSTreeMacro

Diff: diff --git a/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml b/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml
index d3667eaa82706..5e3cccb2426ef 100644
--- a/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml
@@ -53,10 +53,16 @@
       <artifactId>xwiki-platform-tree-macro</artifactId>
       <version>${project.version}</version>
       <type>xar</type>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+    </dependency>
     <!-- Needed for Wiki Macros -->
     <dependency>
       <groupId>org.xwiki.platform</groupId>
       <artifactId>xwiki-platform-rendering-wikimacro-store</artifactId>
       <version>${project.version}</version>
diff --git a/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml b/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml
index 0affdc406c793..d398ebca11bc6 100644
--- a/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml
+++ b/xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml
@@ -248,11 +248,13 @@
     <property>
       <async_enabled>0</async_enabled>
     </property>
     <property>
       <code>{{velocity}}
-{{tree root="$xcontext.macro.params.root" reference="path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')" links="true"/}}
+#set ($root = $services.rendering.escape($xcontext.macro.params.root, 'xwiki/2.1'))
+#set ($reference = $services.rendering.escape("path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')", 'xwiki/2.1'))
+{{tree root="$root" reference="$reference" links="true"/}}
 {{/velocity}}</code>
     </property>
     <property>
       <contentDescription/>
     </property>

Vulnerable code: {{tree root="$xcontext.macro.params.root" reference="path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')" links="true"/}}
Fixed code:     <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
      <version>${project.version}</version>
      <scope>runtime</scope>
    </dependency>
#set ($root = $services.rendering.escape($xcontext.macro.params.root, 'xwiki/2.1'))
#set ($reference = $services.rendering.escape("path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')", 'xwiki/2.1'))
{{tree root="$root" reference="$reference" links="true"/}}