CVE-2024-31984 (XML, published 2024-04-10T20:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the `Main.SolrSpaceFacet` page.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml
Commit message: XWIKI-21471: Improve escaping in Solr Space Faucet


Vulnerable code:
        <module>xwiki-platform-search-solr-test-utils</module>
    <artifactId>xwiki-platform-search-solr</artifactId>
    $spaceDocument.plainTitle
    $spaceReference.name

Fixed code:
        <module>xwiki-platform-search-solr-test</module>
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
  <packaging>pom</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
  <properties>
    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    <!-- Don't run Checkstyle in test modules -->
    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
  </properties>
  <modules>
    <module>xwiki-platform-search-solr-test-pageobjects</module>
  </modules>
  <profiles>
    <profile>
      <id>integration-tests</id>
      <modules>
        <module>xwiki-platform-search-solr-test-utils</module>
      </modules>
    </profile>
    <profile>
      <id>docker</id>
      <modules>
        <module>xwiki-platform-search-solr-test-docker</module>
      </modules>
    </profile>
  </profiles>
</project>
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
  <packaging>jar</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
  <properties>
    <!-- Functional tests are allowed to output content to the console -->
    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-ui</artifactId>
      <version>${project.version}</version>
      <type>xar</type>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-docker</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <testSourceDirectory>src/test/it</testSourceDirectory>
    <plugins>
      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
      </plugin>
    </plugins>
  </build>
  <profiles>
    <profile>
      <id>clover</id>
      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
      <dependencies>
        <dependency>
          <groupId>org.openclover</groupId>
          <artifactId>clover</artifactId>
        </dependency>
      </dependencies>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-failsafe-plugin</artifactId>
            <configuration>
              <systemPropertyVariables>
                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
                     WEB-INF/lib -->
                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
              </systemPropertyVariables>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.ui;

import org.junit.jupiter.api.Nested;
import org.xwiki.test.docker.junit5.UITest;

/**
 * All UI tests for the Solr Search feature.
 *
 * @version $Id$
 */
@UITest
class AllIT
{
    @Nested
    class NestedSolrSearchIT extends SolrSearchIT
    {
    }
}
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.ui;

import org.junit.jupiter.api.Test;
import org.xwiki.repository.test.SolrTestUtils;
import org.xwiki.search.solr.test.po.SolrSearchPage;
import org.xwiki.test.docker.junit5.TestConfiguration;
import org.xwiki.test.docker.junit5.UITest;
import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
import org.xwiki.test.integration.XWikiExecutor;
import org.xwiki.test.ui.TestUtils;

import static org.junit.jupiter.api.Assertions.assertEquals;

/**
 * Tests Solr search features.
 *
 * @version $Id$
 */
@UITest
class SolrSearchIT
{
    @Test
    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
        setup.loginAsSuperAdmin();

        String testDocumentLocation = "{{/html}}";
        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);

        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();

        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
        searchPage.search("\"Test Document\"");
        searchPage.toggleSpaceFaucet();
        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
    }

    private String computedHostURL(TestConfiguration testConfiguration)
    {
        ServletEngine servletEngine = testConfiguration.getServletEngine();
        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
            XWikiExecutor.DEFAULT_CONTEXT);
    }
}
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
  <packaging>jar</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
  <properties>
    <!-- None of the classes is valid -->
    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-ui</artifactId>
      <version>${project.version}</version>
    </dependency>
  </dependencies>
</project>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.po;

import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;
import org.xwiki.test.ui.po.ViewPage;

public class SolrSearchPage extends ViewPage
{
    @FindBy(id = "search-page-bar-input")
    private WebElement searchInput;

    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
    private WebElement searchButton;

    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
    private WebElement spaceFaucetDropdownButton;

    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
    private WebElement spaceFaucetDropdownContent;

    public static SolrSearchPage gotoPage()
    {
        getUtil().gotoPage("Main", "SolrSearch", "view");
        return new SolrSearchPage();
    }

    public void search(String terms) {
        this.searchInput.clear();
        this.searchInput.sendKeys(terms);
        this.searchButton.click();
    }

    public void toggleSpaceFaucet() {
        this.spaceFaucetDropdownButton.click();
    }

    public String getSpaceFaucetContent() {
        return this.spaceFaucetDropdownContent.getText();
    }
}
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    $escapetool.xml($spaceDocument.plainTitle)
    $escapetool.xml($spaceReference.name)