CVE-2023-26056: Incorrect Authorization (CWE-863)
value: XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.4
Published: 2023-03-02T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java, xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java
Commit date: 2022-09-09 14:57:55 +0200
Commit message: XWIKI-19856: Bad execution setup on the context macro
* 13.10.x compatible test

Diff: diff --git a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
index c01d8c452857..42fd62061bf5 100644
--- a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
+++ b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
@@ -167,10 +167,12 @@ public List<Block> execute(ContextMacroParameters parameters, String content, Ma
         }
 
         // Reuse the very generic async rendering framework (even if we don't do async and caching) since it's taking
         // care of many other things
         BlockAsyncRendererConfiguration configuration = createBlockAsyncRendererConfiguration(null, xdom, context);
+        configuration.setAsyncAllowed(false);
+        configuration.setCacheAllowed(false);
 
         Map<String, Object> backupObjects = new HashMap<>();
         try {
             // Switch the context document
             this.documentAccessBridge.pushDocumentInContext(backupObjects, referencedDocReference);
diff --git a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java
index 860ad849cb84..56e193049b6e 100644
--- a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java
+++ b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java
@@ -20,11 +20,10 @@
 package org.xwiki.rendering.internal.macro.context;
 
 import java.util.Arrays;
 import java.util.Collections;
 
-import javax.inject.Inject;
 import javax.inject.Named;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
@@ -49,12 +48,14 @@
 import org.xwiki.security.authorization.AuthorizationManager;
 import org.xwiki.security.authorization.Right;
 import org.xwiki.test.TestEnvironment;
 import org.xwiki.test.annotation.ComponentList;
 import org.xwiki.test.junit5.mockito.ComponentTest;
+import org.xwiki.test.junit5.mockito.InjectComponentManager;
 import org.xwiki.test.junit5.mockito.InjectMockComponents;
 import org.xwiki.test.junit5.mockito.MockComponent;
+import org.xwiki.test.mockito.MockitoComponentManager;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
@@ -78,13 +79,10 @@
 
     private static final DocumentReference TARGET_REFERENCE = new DocumentReference("wiki", "space", "target");
 
     private static final DocumentReference SOURCE_REFERENCE = new DocumentReference("wiki", "space", "source");
 
-    @Inject
-    protected BlockAsyncRendererExecutor executor;
-
     @MockComponent
     private DocumentAccessBridge dab;
 
     @MockComponent
     private BeanManager beanManager;
@@ -98,15 +96,20 @@
     @MockComponent
     @Named("macro")
     private DocumentReferenceResolver<String> macroReferenceResolver;
 
     @MockComponent
-    protected DocumentReferenceResolver<String> resolver;
+    private DocumentReferenceResolver<String> resolver;
 
     @InjectMockComponents
     private ContextMacro macro;
 
+    @InjectComponentManager
+    private MockitoComponentManager componentManager;
+
+    private BlockAsyncRendererExecutor executor;
+
     @BeforeEach
     public void beforeEach() throws Exception
     {
         // Macro Descriptor set up
         BeanDescriptor descriptor = mock(BeanDescriptor.class);
@@ -115,10 +118,12 @@ public void beforeEach() throws Exception
 
         when(this.dab.getCurrentAuthorReference()).thenReturn(AUTHOR);
 
         when(this.macroReferenceResolver.resolve(eq("target"), any())).thenReturn(TARGET_REFERENCE);
         when(this.resolver.resolve("source")).thenReturn(SOURCE_REFERENCE);
+
+        this.executor = this.componentManager.getInstance(BlockAsyncRendererExecutor.class);
     }
 
     @Test
     void executeWhenNoDocumentSpecified() throws Exception
     {

Vulnerable code: import javax.inject.Inject;
    @Inject
    protected BlockAsyncRendererExecutor executor;

    protected DocumentReferenceResolver<String> resolver;
Fixed code:         configuration.setAsyncAllowed(false);
        configuration.setCacheAllowed(false);
import org.xwiki.test.junit5.mockito.InjectComponentManager;
import org.xwiki.test.mockito.MockitoComponentManager;
    private DocumentReferenceResolver<String> resolver;
    @InjectComponentManager
    private MockitoComponentManager componentManager;

    private BlockAsyncRendererExecutor executor;


        this.executor = this.componentManager.getInstance(BlockAsyncRendererExecutor.class);