CVE-2023-29214: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2023-04-16T07:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml
Commit date: 2022-10-28 16:55:03 +0200
Commit message: XWIKI-20293: Improved IncludedDocuments panel escaping

Diff: diff --git a/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml b/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml
index 5eee5aca6940b..e368fff5033d8 100644
--- a/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml
+++ b/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml
@@ -123,18 +123,21 @@
 #set ($pages = $tdoc.includedPages)
 #if ($pages.size() &gt; 0 || $showEmptyPanels)
 #largepanelheader($services.localization.render('xe.panels.includedDocs.title'))
 $services.localization.render('xe.panels.includedDocs.count', [$pages.size()])
 #foreach ($page in $pages)
-  * [[$page&gt;&gt;$page]] [[[[image:icon:page_white_edit||alt="$services.localization.render('panels.documentInformation.editIncluded', [$page])"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
+  #set ($pageLink = $services.rendering.escape($page, 'xwiki/2.1'))
+  #set ($pageName = $services.rendering.escape($services.rendering.escape($page, 'xwiki/2.1'), 'xwiki/2.1'))
+  #set ($alt = $services.rendering.escape($services.localization.render('panels.documentInformation.editIncluded', [$page]), 'xwiki/2.1'))
+  * [[$pageName&gt;&gt;$pageLink]] [[[[image:icon:page_white_edit||alt="$alt"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
 #end
 #panelfooter()
 #end
 {{/velocity}}</content>
     </property>
     <property>
-      <description>Displays the documents included in the curent document.</description>
+      <description>Displays the documents included in the current document.</description>
     </property>
     <property>
       <name>Included Documents</name>
     </property>
     <property>

Vulnerable code:   * [[$page&gt;&gt;$page]] [[[[image:icon:page_white_edit||alt="$services.localization.render('panels.documentInformation.editIncluded', [$page])"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
      <description>Displays the documents included in the curent document.</description>
Fixed code:   #set ($pageLink = $services.rendering.escape($page, 'xwiki/2.1'))
  #set ($pageName = $services.rendering.escape($services.rendering.escape($page, 'xwiki/2.1'), 'xwiki/2.1'))
  #set ($alt = $services.rendering.escape($services.localization.render('panels.documentInformation.editIncluded', [$page]), 'xwiki/2.1'))
  * [[$pageName&gt;&gt;$pageLink]] [[[[image:icon:page_white_edit||alt="$alt"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
      <description>Displays the documents included in the current document.</description>