Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
Date: 2022-11
Affected: maven/org.xwiki.platform:xwiki-platform-attachment-ui, maven/org.xwiki.platform:xwiki-platform-attachment-ui
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-41928
CWE: CWE-95
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

### Impact Any user with the right to edit his personal page can follow one of the scenario below: **Scenario 1**: - Log in as a simple user with just edit rights on the user profile - Go to the user's profile - Upload an attachment in the attachment tab at the bottom of the page (any image is fine) - Click on "rename" in the attachment list and enter `{{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/async}}.png` as new attachment name and submit the rename - Go back to the user profile - Click on the edit icon on the user avatar - `Hello from groovy!` is displayed as the title of the attachment **Scenario 2**: - Log in as a simple user with just edit rights on a page - Create a Page `MyPage.WebHome` - Create an XClass field of type String named `avatar` - Add an XObject of type `MyPage.WebHome` on the page - Insert an `attachmentSelector` macro in the document with the following values: - **classname**: `MyPage.WebHome` - **property**: `avatar` - **savemode**: `direct` - **displayImage**: `true` - **width**: `]] {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/async}}`. You'll find below a snippet of an `attachmentSelector` macro declaration. - Display the page - Use the attachment picker to select an image - `Hello from groovy` is displayed aside the image Example of an `attachmentSelector` macro declaration: ``` `{{attachmentSelecto


Mitigations:

Architectural layers (MAESTRO):