CVE-2023-29511: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CVSS v3 base score: 8.8
Published: 2023-04-16T08:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml, xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml, xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/AdminFieldsDisplaySheetPageTest.java
Commit date: 2022-11-29 16:29:53 +0100
Commit message: XWIKI-20261: Improved escaping of AdminFieldsDisplaySheet

Diff: diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml
index 955434ec58785..660db23862ca6 100644
--- a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml
@@ -89,10 +89,31 @@
     <dependency>
       <groupId>org.webjars</groupId>
       <artifactId>bootstrap-select</artifactId>
       <scope>runtime</scope>
     </dependency>
+    <!-- Test dependencies. -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-page</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.commons</groupId>
+      <artifactId>xwiki-commons-script</artifactId>
+      <version>${commons.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <!-- Provides the component list for RenderingScriptService. -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
   <build>
     <plugins>
       <plugin>
         <groupId>org.xwiki.commons</groupId>
diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml
index 1ef963c2a502d..288c4069f167a 100644
--- a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml
+++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml
@@ -114,15 +114,18 @@
     #set($formId = "${section.toLowerCase()}_${configClassName}")
   #else
     #set($configClassName = 'XWiki.XWikiPreferences')
     #set($formId = $section.toLowerCase())
   #end
-  &lt;form id="$formId" method="post" action="$xwiki.getURL($configDoc, 'saveandcontinue')" onsubmit="cancelCancelEdit()" class="xform"&gt;
+  &lt;form id="$escapetool.xml($formId)" method="post"
+      action="$escapetool.xml($xwiki.getURL($configDoc, 'saveandcontinue'))"
+      onsubmit="cancelCancelEdit()"
+      class="xform"&gt;
     #set($obj = $configDoc.getObject($configClassName))
     #foreach ($entry in $params.entrySet())
       #set ($fields = $entry.value)
-      &lt;fieldset class="$entry.key"&gt;
+      &lt;fieldset class="$escapetool.xml($entry.key)"&gt;
       ## If there is only one section, don't display the legend
       #if ($params.size() &gt; 1)
         &lt;legend&gt;$services.localization.render("admin.$entry.key")&lt;/legend&gt;
       #end
       #if ($fields.size() &gt; 0)
@@ -143,11 +146,11 @@
     #end
     &lt;div class="hidden"&gt;
       &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
       &lt;input type="hidden" name="xcontinue" value="$xwiki.getURL($currentDoc, 'admin', "editor=${escapetool.url(${editor})}&amp;amp;section=${escapetool.url(${section})}&amp;amp;space=${escapetool.url(${currentSpace})}")" /&gt;
       &lt;input type="hidden" name="xredirect" value="$xwiki.getURL($currentDoc, 'admin', "editor=${escapetool.url(${editor})}&amp;amp;section=${escapetool.url(${section})}&amp;amp;space=${escapetool.url(${currentSpace})}")" /&gt;
-      &lt;input type="hidden" name="classname" value="$configClassName" /&gt;
+      &lt;input type="hidden" name="classname" value="$escapetool.xml($configClassName)" /&gt;
       #if ("$!objectPolicy" != '')
       &lt;input type="hidden" name="objectPolicy" value="$escapetool.xml($objectPolicy)" /&gt;
       #end
     &lt;/div&gt;
     &lt;div class="bottombuttons"&gt;
diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/AdminFieldsDisplaySheetPageTest.java b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/AdminFieldsDisplaySheetPageTest.java
new file mode 100644
index 0000000000000..2b2f8312e334f
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/AdminFieldsDisplaySheetPageTest.java
@@ -0,0 +1,99 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.administration;
+
+import java.util.Map;
+
+import javax.script.ScriptContext;
+
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.Element;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xwiki.model.reference.DocumentReference;
+import org.xwiki.rendering.RenderingScriptServiceComponentList;
+import org.xwiki.rendering.internal.configuration.DefaultExtendedRenderingConfiguration;
+import org.xwiki.rendering.internal.configuration.RenderingConfigClassDocumentConfigurationSource;
+import org.xwiki.script.ScriptContextManager;
+import org.xwiki.test.annotation.ComponentList;
+import org.xwiki.test.page.HTML50ComponentList;
+import org.xwiki.test.page.PageTest;
+import org.xwiki.test.page.TestNoScriptMacro;
+import org.xwiki.test.page.XWikiSyntax21ComponentList;
+
+import static java.util.Collections.emptyList;
+import static java.util.Collections.singletonMap;
+import static javax.script.ScriptContext.ENGINE_SCOPE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Page test of {@code XWiki.AdminFieldsDisplaySheet}.
+ *
+ * @version $Id$
+ * @since 15.0RC1
+ * @since 14.10.1
+ * @since 14.4.8
+ * @since 13.10.11
+ */
+@HTML50ComponentList
+@XWikiSyntax21ComponentList
+@RenderingScriptServiceComponentList
+@ComponentList({
+    TestNoScriptMacro.class,
+    DefaultExtendedRenderingConfiguration.class,
+    RenderingConfigClassDocumentConfigurationSource.class
+})
+class AdminFieldsDisplaySheetPageTest extends PageTest
+{
+    private ScriptContext scriptContext;
+
+    @BeforeEach
+    void setUp() throws Exception
+    {
+        this.scriptContext =
+            this.oldcore.getMocker().<ScriptContextManager>getInstance(ScriptContextManager.class).getScriptContext();
+    }
+
+    @Test
+    void escaping() throws Exception
+    {
+        String paramsInput = "\"/><script>console.log('params');</script>{{/html}}{{noscript/}}";
+        String sectionInput = "\"/><strong>console.log('section');</script>{{/html}}{{noscript/}}";
+        String paramClassInput = "\"/><script>console.log('paramClass');</script>{{/html}}{{noscript/}}";
+        Map<Object, Object> params = singletonMap(paramsInput, emptyList());
+        DocumentReference otherDocumentReference = new DocumentReference("xwiki", "Space", "Page");
+        com.xpn.xwiki.api.Document otherDocument =
+            new com.xpn.xwiki.api.Document(this.xwiki.getDocument(otherDocumentReference, this.context), this.context);
+
+        this.scriptContext.setAttribute("section", sectionInput, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("paramDoc", otherDocument, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("params", params, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("paramClass", paramClassInput, ENGINE_SCOPE);
+
+        Document document = renderHTMLPage(new DocumentReference("xwiki", "XWiki", "AdminFieldsDisplaySheet"));
+
+        Element form = document.selectFirst("form");
+        assertEquals(String.format("%s_%s", sectionInput, paramClassInput), form.attr("id"));
+        assertEquals("/xwiki/bin/saveandcontinue/Space/Page", form.attr("action"));
+        Element fieldset = form.selectFirst("fieldset");
+        assertEquals(paramsInput, fieldset.attr("class"));
+        assertEquals(paramClassInput, document.selectFirst(".hidden input[name='classname']").val());
+    }
+}

Vulnerable code:   &lt;form id="$formId" method="post" action="$xwiki.getURL($configDoc, 'saveandcontinue')" onsubmit="cancelCancelEdit()" class="xform"&gt;
      &lt;fieldset class="$entry.key"&gt;
      &lt;input type="hidden" name="classname" value="$configClassName" /&gt;
Fixed code:     <!-- Test dependencies. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-page</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.commons</groupId>
      <artifactId>xwiki-commons-script</artifactId>
      <version>${commons.version}</version>
      <scope>test</scope>
    </dependency>
    <!-- Provides the component list for RenderingScriptService. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
      <version>${project.version}</version>
      <type>test-jar</type>
      <scope>test</scope>
    </dependency>
  &lt;form id="$escapetool.xml($formId)" method="post"
      action="$escapetool.xml($xwiki.getURL($configDoc, 'saveandcontinue'))"
      onsubmit="cancelCancelEdit()"
      class="xform"&gt;
      &lt;fieldset class="$escapetool.xml($entry.key)"&gt;
      &lt;input type="hidden" name="classname" value="$escapetool.xml($configClassName)" /&gt;
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.administration;

import java.util.Map;

import javax.script.ScriptContext;

import org.jsoup.nodes.Document;
import org.jsoup.nodes.Element;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.xwiki.model.reference.DocumentReference;
import org.xwiki.rendering.RenderingScriptServiceComponentList;
import org.xwiki.rendering.internal.configuration.DefaultExtendedRenderingConfiguration;
import org.xwiki.rendering.internal.configuration.RenderingConfigClassDocumentConfigurationSource;
import org.xwiki.script.ScriptContextManager;
import org.xwiki.test.annotation.ComponentList;
import org.xwiki.test.page.HTML50ComponentList;
import org.xwiki.test.page.PageTest;
import org.xwiki.test.page.TestNoScriptMacro;
import org.xwiki.test.page.XWikiSyntax21ComponentList;

import static java.util.Collections.emptyList;
import static java.util.Collections.singletonMap;
import static javax.script.ScriptContext.ENGINE_SCOPE;
import static org.junit.jupiter.api.Assertions.assertEquals;

/**
 * Page test of {@code XWiki.AdminFieldsDisplaySheet}.
 *
 * @version $Id$
 * @since 15.0RC1
 * @since 14.10.1
 * @since 14.4.8
 * @since 13.10.11
 */
@HTML50ComponentList
@XWikiSyntax21ComponentList
@RenderingScriptServiceComponentList
@ComponentList({
    TestNoScriptMacro.class,
    DefaultExtendedRenderingConfiguration.class,
    RenderingConfigClassDocumentConfigurationSource.class
})
class AdminFieldsDisplaySheetPageTest extends PageTest
{
    private ScriptContext scriptContext;

    @BeforeEach
    void setUp() throws Exception
    {
        this.scriptContext =
            this.oldcore.getMocker().<ScriptContextManager>getInstance(ScriptContextManager.class).getScriptContext();
    }

    @Test
    void escaping() throws Exception
    {
        String paramsInput = "\"/><script>console.log('params');</script>{{/html}}{{noscript/}}";
        String sectionInput = "\"/><strong>console.log('section');</script>{{/html}}{{noscript/}}";
        String paramClassInput = "\"/><script>console.log('paramClass');</script>{{/html}}{{noscript/}}";
        Map<Object, Object> params = singletonMap(paramsInput, emptyList());
        DocumentReference otherDocumentReference = new DocumentReference("xwiki", "Space", "Page");
        com.xpn.xwiki.api.Document otherDocument =
            new com.xpn.xwiki.api.Document(this.xwiki.getDocument(otherDocumentReference, this.context), this.context);

        this.scriptContext.setAttribute("section", sectionInput, ENGINE_SCOPE);
        this.scriptContext.setAttribute("paramDoc", otherDocument, ENGINE_SCOPE);
        this.scriptContext.setAttribute("params", params, ENGINE_SCOPE);
        this.scriptContext.setAttribute("paramClass", paramClassInput, ENGINE_SCOPE);

        Document document = renderHTMLPage(new DocumentReference("xwiki", "XWiki", "AdminFieldsDisplaySheet"));

        Element form = document.selectFirst("form");
        assertEquals(String.format("%s_%s", sectionInput, paramClassInput), form.attr("id"));
        assertEquals("/xwiki/bin/saveandcontinue/Space/Page", form.attr("action"));
        Element fieldset = form.selectFirst("fieldset");
        assertEquals(paramsInput, fieldset.attr("class"));
        assertEquals(paramClassInput, document.selectFirst(".hidden input[name='classname']").val());
    }
}