CVE-2022-36092: Improper Authentication (CWE-287)
value: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2022-09-08T18:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
Commit date: 2022-03-25 11:14:51 +0100
Commit message: XWIKI-19549: Disallow template override for login, register and skin

* Also allow `registerinline` template for RegisterAction.

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
index 907df84aad10..c3a61e9010da 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
@@ -17,10 +17,13 @@
  * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 package com.xpn.xwiki.web;
 
+import java.util.Arrays;
+import java.util.List;
+
 import javax.inject.Named;
 import javax.inject.Singleton;
 import javax.script.ScriptContext;
 
 import org.apache.commons.lang3.exception.ExceptionUtils;
@@ -53,21 +56,24 @@ public class RegisterAction extends XWikiAction
     private static final Logger LOGGER = LoggerFactory.getLogger(RegisterAction.class);
 
     /** Space where the registration config and class are stored. */
     private static final String WIKI_SPACE = "XWiki";
 
+    /** Allowed templates for this action. */
+    private static final List<String> ALLOWED_TEMPLATES = Arrays.asList(REGISTER, "registerinline");
+
     @Override
     public boolean action(XWikiContext context) throws XWikiException
     {
         XWiki xwiki = context.getWiki();
         XWikiRequest request = context.getRequest();
         XWikiResponse response = context.getResponse();
 
-        // Disallow template override with xpage parameter.
-        if (!REGISTER.equals(Utils.getPage(context.getRequest(), REGISTER))) {
+        // Limit template overrides with xpage to allowed templates.
+        if (!ALLOWED_TEMPLATES.contains(Utils.getPage(context.getRequest(), REGISTER))) {
             throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
-                String.format("Template may not be overriden with 'xpage' in [%s] action.", REGISTER));
+                String.format("Forbidden template override with 'xpage' in [%s] action.", REGISTER));
         }
 
         String register = request.getParameter(REGISTER);
         if (register != null && register.equals("1")) {
             // CSRF prevention

Vulnerable code:         // Disallow template override with xpage parameter.
        if (!REGISTER.equals(Utils.getPage(context.getRequest(), REGISTER))) {
                String.format("Template may not be overriden with 'xpage' in [%s] action.", REGISTER));
Fixed code: import java.util.Arrays;
import java.util.List;

    /** Allowed templates for this action. */
    private static final List<String> ALLOWED_TEMPLATES = Arrays.asList(REGISTER, "registerinline");

        // Limit template overrides with xpage to allowed templates.
        if (!ALLOWED_TEMPLATES.contains(Utils.getPage(context.getRequest(), REGISTER))) {
                String.format("Forbidden template override with 'xpage' in [%s] action.", REGISTER));