CVE-2023-29525: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-04-19T00:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml
Commit date: 2022-12-30 14:12:29 +0100
Commit message: XWIKI-20287: Improve migration date display

Diff: diff --git a/xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml b/xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml
index 8e0970634cbfd..ef87b9c42da22 100644
--- a/xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml
+++ b/xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml
@@ -65,11 +65,11 @@
     &lt;label for="mode_alltime"&gt;$services.localization.render('legacy.event.migration.alltime')&lt;/label&gt;
   &lt;/div&gt;
   &lt;div&gt;
     &lt;input type="radio" id="mode_since" name="mode" value="since"#if($request.mode == 'since')checked#end/&gt;
     &lt;label for="mode_since"&gt;$escapetool.html($services.localization.render('legacy.event.migration.since'))&lt;/label&gt;
-    &lt;input type="date" id="since" name="since" value="$!request.since" max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
+    &lt;input type="date" id="since" name="since"#if($request.since) value="$escapetool.xml($request.since)"#end max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
   &lt;/div&gt;
   &lt;div class="buttons"&gt;&lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$escapetool.xml($services.localization.render('legacy.event.migration.start'))" name="migrate" class="button"/&gt;&lt;/span&gt;&lt;/div&gt;
 &lt;/form&gt;
 
 #set($jobStatus = $services.eventstream.getLegacyMigrationStatus())

Vulnerable code:     &lt;input type="date" id="since" name="since" value="$!request.since" max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
Fixed code:     &lt;input type="date" id="since" name="since"#if($request.since) value="$escapetool.xml($request.since)"#end max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;