GHSA-q2hm-2h45-v5g3: Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default
ImpactWe discovered that when the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and next versions.
Note that it only concerns the reset password feature available from the "Forgot your password" link in the login view: the features allowing a user to change their password, or for an admin to change a user password are not impacted.This vulnerability is particularly dangerous in combination with other vulnerabilities allowing to perform data leak of personal data from users, such as https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm.Note that this vulnerability only concerns the users of the main wiki: in case of farms, the users registered on subwiki are not impacted thanks to a bug we discovered when investigating this.PatchesThe problem has been patched in version 14.6RC1, 14.4.3 and 13.10.8.The patch involves a migration of the impacted users as well as the history of the page, to ensure no password remains in plain text in the database. This migration also involves to inform the users about the possible disclosure of their passwords: by default, two emails are automatically sent to the impacted users. A first email to inform about the possibility that their password have been leaked, and a second email using the reset password feature to ask them to set a new password. See below for the configuration options to disable the mail sending.The first email contains by default the following text (could be translated depending on the wiki language settings):It's possible to specify another text by creating a file at the root of the permanent directory named `140600000XWIKI19869-mail.txt`, this file should have same structure as used above:This mail is sent plain text and cannot contain any variable. 
Note that the second mail for the reset password is using the standard feature, so you can find information about the email templates [there](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Authentication/#HMailTemplates).
Also note that if the users doesn't have any registered email address obviously no mail will be sent, so it's the administrators responsibility to find a way to contact the user (through comment on the user profile, or any other channel used for that wiki). The administrator should be particularly careful on the presence of logs such as:It's also possible for administrators to set some properties for the migration: it's possible to decide if the user password should be reset (default) or if the passwords should be kept but only hashed. Note that in the first option, the users won't be able to login anymore until they set a new password if they were impacted. Note that in both options, mails will be sent to users to inform them and encourage them to change their passwords.Two other properties are available to chose the behaviour regarding the mails to be sent: it's possible to chose to only send the first security email, or to only send the reset password email. It's important to note that those emails are sent after the migration during the initialization of the wiki, by reading a file creating by the migration in the permanent directory (the file is named `140600000XWIKI19869DataMigration-users.txt`): then it's possible for an administrator to chose to not sent any email when the migration is performed (by setting the properties to false), and to send them later in a future restart by then setting back the properties to true before the restart of the wiki. Also note that the file is deleted after the mails are sent.The mentioned properties can be found in `xwiki.properties` in the `[Security]` section:WorkaroundsThere is actually 2 parts of the vulnerability:users who might have use the reset feature should get their password protected. We provide some instructions how to identify and fix those.the next usage of the reset password feature shouldn't lead to plain text password: sadly there is no easy workaround for that, except by recompiling `xwiki-platform-security-authentication-default` with that change: https://github.com/xwiki/xwiki-platform/commit/443e8398b75a1295067d74afb5898370782d863a#diff-f8a8f8ba80dfc55f044e2e60b521ce379176430ca6921b0f87b79cf682531f79L322It's possible to identify all impacted users and to manually reset their passwords with an Admin account. For identifying the impacted users, a query such as the following is possible:Once impacted users are identified at least 2 options are possible:Set a new password (manually by going to the user profile, or automatically with a groovy script for example)rollback to a previous version of the user document: in such case the password will be automatically processed properlyBe aware that those workarounds won't remove the clear password entry that might remain in database due to history.ReferencesJira ticket: https://jira.xwiki.org/browse/XWIKI-19869Advisory of a data leak vulnerability that increases the criticality of this vulnerability: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrmBug discovered "protecting" subwiki from this vulnerability: https://jira.xwiki.org/browse/XWIKI-19945For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira](https://jira.xwiki.org)Email us at [security ML](mailto:security@xwiki.org)
CVSS v3.1: 6.2