CVE-2023-46244 (Java, published 2023-11-07T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. Since this API require programming right and the user does not have it, the expected result is `$doc.document.authors.contentAuthor` (not executed script), unfortunately with the security vulnerability it is possible for the attacker to get `XWiki.superadmin` which shows that the title was executed with the right of the unmodified document. This has been patched in XWiki versions 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java
xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/test/java/org/xwiki/display/internal/DocumentTitleDisplayerTest.java
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AllITs.java
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/ScriptAuthorIT.java
Commit message: XWIKI-20624: Improve title display for modified documents


Vulnerable code:
                    title = evaluateTitle(rawTitle, document.getDocumentReference(), parameters);
    protected String evaluateTitle(String title, DocumentReference documentReference,
            ? documentReference : documentAccessBridge.getCurrentDocumentReference());
                documentAccessBridge.pushDocumentInContext(backupObjects, documentReference);
                modelContext.setCurrentEntityReference(documentReference.getWikiReference());
        verify(dab).pushDocumentInContext(any(), eq(documentReference));

Fixed code:
                    title = evaluateTitle(rawTitle, document, parameters);
    protected String evaluateTitle(String title, DocumentModelBridge document,
            ? document.getDocumentReference() : documentAccessBridge.getCurrentDocumentReference());
                documentAccessBridge.pushDocumentInContext(backupObjects, document);
                modelContext.setCurrentEntityReference(document.getDocumentReference().getWikiReference());
import static org.mockito.ArgumentMatchers.same;
        verify(dab).pushDocumentInContext(any(), same(document));

    @Nested
    @DisplayName("Script author Tests")
    class NestedScriptAuthorIT extends ScriptAuthorIT
    {
    }
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.flamingo.test.docker;

import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Order;
import org.junit.jupiter.api.Test;
import org.xwiki.model.reference.DocumentReference;
import org.xwiki.test.docker.junit5.TestReference;
import org.xwiki.test.docker.junit5.UITest;
import org.xwiki.test.ui.TestUtils;

import static org.junit.jupiter.api.Assertions.assertEquals;

/**
 * Make sure a script end up being executed by the right author in various use cases.
 *
 * @version $Id$
 */
@UITest
class ScriptAuthorIT
{
    @BeforeAll
    public void setup(TestUtils setup)
    {
        setup.loginAsSuperAdmin();
    }

    @Test
    @Order(1)
    void renderTitleInModifiedDocument(TestUtils setup, TestReference reference) throws Exception
    {
        // Give a page programming right
        setup.loginAsSuperAdmin();
        DocumentReference programmingReference = reference;
        setup.rest().savePage(programmingReference);

        // Write a script without programming right
        setup.createUser("renderTitleInModifiedDocument", "renderTitleInModifiedDocument", null);
        setup.setGlobalRights(null, "renderTitleInModifiedDocument", "script", true);
        setup.login("renderTitleInModifiedDocument", "renderTitleInModifiedDocument");
        DocumentReference scriptReference =
            new DocumentReference("Script", programmingReference.getLastSpaceReference());
        StringBuilder source = new StringBuilder();
        source.append("{{velocity}}\n");
        source.append("#set($main = $xwiki.getDocument('" + setup.serializeReference(programmingReference) + "'))\n");
        source.append("$main.setTitle('$doc.document.authors.contentAuthor')\n");
        source.append("$main.getPlainTitle()\n");
        source.append("{{/velocity}}");
        setup.rest().savePage(scriptReference, source.toString(), "sheet title");

        StringBuilder result = new StringBuilder();
        result.append("<p>$doc.document.authors.contentAuthor</p>");
        assertEquals(result.toString(), setup.executeAndGetBodyAsString(scriptReference, null));
    }
}