CVE-2024-31988 (XML, published 2024-04-10T21:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, by getting an admin user to either visit a crafted URL or to view an image with this URL that could be in a comment, the attacker can get the admin to execute arbitrary XWiki syntax including scripting macros with Groovy or Python code. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9. As a workaround, one may update `RTFrontend.ConvertHTML` manually with the patch. This will, however, break some synchronization processes in the realtime editor, so upgrading should be the preferred way on installations where this editor is used.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-ui/pom.xml
xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-ui/src/main/resources/RTFrontend/ConvertHTML.xml
xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-ui/src/main/resources/XWiki/Realtime/Translations.xml
xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-ui/src/test/java/org/xwiki/realtime/ui/ConvertHTMLPageTest.java
xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-webjar/src/main/webjar/loader.js
Commit message: XWIKI-21424: Use CSRF token in the realtime HTML Converter API

* Add a mandatory CSRF token to use RTFrontend.ConvertHTML
* Add a page test for RTFrontend.ConvertHTML that checks for the proper use of the CSRF token
* Improve URL creation and add Translations.xml


Vulnerable code:
<xwikidoc version="1.4" reference="RTFrontend.ConvertHTML" locale="">
  ## FIXME: We shouldn't depend on CKEditor. This code should work independent of the configured WYSIWYG editor.
  $xwiki.getDocument('CKEditor.ContentSheet').getRenderedContent()
      htmlConverterUrl: new XWiki.Document('ConvertHTML', 'RTFrontend').getURL('get', 'xpage=plain&outputSyntax=plain'),

Fixed code:
    <!-- Test dependencies. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-page</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <!-- Provides the component list for RenderingScriptService. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
      <version>${project.version}</version>
      <type>test-jar</type>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-configuration-default</artifactId>
      <version>${project.version}</version>
      <type>test-jar</type>
      <scope>test</scope>
    </dependency>
<xwikidoc version="1.5" reference="RTFrontend.ConvertHTML" locale="">
  ## Check that the CSRF token matches the user.
  #if (!$services.csrf.isTokenValid($request.form_token))
    $response.sendError(403, $services.localization.render('rtfFrontend.convertHtml.invalidCsrfToken'))
  #else
    ## FIXME: We shouldn't depend on CKEditor. This code should work independent of the configured WYSIWYG editor.
    $xwiki.getDocument('CKEditor.ContentSheet').getRenderedContent()
  #end
<?xml version="1.1" encoding="UTF-8"?>

<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->

<xwikidoc version="1.5" reference="XWiki.Realtime.Translations" locale="">
  <web>XWiki.Realtime</web>
  <name>Translations</name>
  <language/>
  <defaultLanguage>en</defaultLanguage>
  <translation>0</translation>
  <creator>xwiki:XWiki.Admin</creator>
  <parent>Main.WebHome</parent>
  <author>xwiki:XWiki.Admin</author>
  <contentAuthor>xwiki:XWiki.Admin</contentAuthor>
  <version>1.1</version>
  <title/>
  <comment/>
  <minorEdit>false</minorEdit>
  <syntaxId>plain/1.0</syntaxId>
  <hidden>true</hidden>
  <content>rtfFrontend.convertHtml.invalidCsrfToken=Invalid CSRF Token</content>
  <object>
    <name>XWiki.Realtime.Translations</name>
    <number>0</number>
    <className>XWiki.TranslationDocumentClass</className>
    <guid>41105c55-62ec-47bc-9dd0-c502cad68de6</guid>
    <class>
      <name>XWiki.TranslationDocumentClass</name>
      <customClass/>
      <customMapping/>
      <defaultViewSheet/>
      <defaultEditSheet/>
      <defaultWeb/>
      <nameField/>
      <validationScript/>
      <scope>
        <cache>0</cache>
        <disabled>0</disabled>
        <displayType>select</displayType>
        <freeText>forbidden</freeText>
        <largeStorage>0</largeStorage>
        <multiSelect>0</multiSelect>
        <name>scope</name>
        <number>1</number>
        <prettyName>Scope</prettyName>
        <relationalStorage>0</relationalStorage>
        <separator> </separator>
        <separators>|, </separators>
        <size>1</size>
        <unmodifiable>0</unmodifiable>
        <values>GLOBAL|WIKI|USER|ON_DEMAND</values>
        <classType>com.xpn.xwiki.objects.classes.StaticListClass</classType>
      </scope>
    </class>
    <property>
      <scope>WIKI</scope>
    </property>
  </object>
</xwikidoc>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.realtime.ui;

import javax.inject.Provider;

import org.jsoup.nodes.Document;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.xwiki.csrf.script.CSRFTokenScriptService;
import org.xwiki.model.reference.DocumentReference;
import org.xwiki.rendering.RenderingScriptServiceComponentList;
import org.xwiki.rendering.internal.configuration.DefaultRenderingConfigurationComponentList;
import org.xwiki.script.service.ScriptService;
import org.xwiki.test.page.HTML50ComponentList;
import org.xwiki.test.page.PageTest;
import org.xwiki.test.page.XWikiSyntax21ComponentList;

import com.xpn.xwiki.XWikiContext;
import com.xpn.xwiki.user.api.XWikiRightService;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.mockito.ArgumentMatchers.anyInt;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

@RenderingScriptServiceComponentList
@DefaultRenderingConfigurationComponentList
@HTML50ComponentList
@XWikiSyntax21ComponentList
class ConvertHTMLPageTest extends PageTest
{

    private static final String WIKI_NAME = "xwiki";

    private static final String XWIKI_SPACE = "RTFrontend";

    private static final DocumentReference RTF_FRONTEND_CONVERT_HTML =
        new DocumentReference(WIKI_NAME, XWIKI_SPACE, "ConvertHTML");

    private static final String CSRF_TOKEN = "a0a0a0a0";

    private CSRFTokenScriptService tokenService;

    @BeforeEach
    void setUp() throws Exception
    {
        // Mock the Token Service to get a consistent CSRF token throughout the tests.
        this.tokenService = this.oldcore.getMocker().registerMockComponent(ScriptService.class, "csrf",
            CSRFTokenScriptService.class, true);
        when(this.tokenService.isTokenValid(CSRF_TOKEN)).thenReturn(true);

        this.xwiki.initializeMandatoryDocuments(this.context);

        this.context = mock(XWikiContext.class);
        Provider<XWikiContext> xcontextProvider =
            this.componentManager.registerMockComponent(XWikiContext.TYPE_PROVIDER);
        when(xcontextProvider.get()).thenReturn(this.context);
        when(this.context.getRequest()).thenReturn(this.request);
        when(this.context.getResponse()).thenReturn(this.response);
        when(this.context.getWiki()).thenReturn(this.xwiki);

        // Fake programming access level to display the complete page.
        XWikiRightService rightService = this.oldcore.getMockRightService();
        when(this.xwiki.getRightService()).thenReturn(rightService);
        when(rightService.hasProgrammingRights(this.context)).thenReturn(true);
        this.response = spy(this.response);
        when(this.context.getResponse()).thenReturn(this.response);
    }

    @Test
    void checkValidCSRFToken() throws Exception
    {
        when(this.context.getAction()).thenReturn("get");
        this.request.put("text", "Hello");
        this.request.put("form_token", CSRF_TOKEN);
        Document result = renderHTMLPage(RTF_FRONTEND_CONVERT_HTML);

        verify(this.response, never()).setStatus(anyInt());
        verify(this.tokenService).isTokenValid(CSRF_TOKEN);
        assertEquals("$xwiki.getDocument('CKEditor.ContentSheet').getRenderedContent()",
            result.getElementsByTag("body").text());
    }

    @Test
    void checkInvalidCSRFToken() throws Exception
    {
        String wrongToken = "wrong_token";
        when(this.context.getAction()).thenReturn("get");
        this.request.put("text", "Hello");
        this.request.put("form_token", wrongToken);
        Document result = renderHTMLPage(RTF_FRONTEND_CONVERT_HTML);

        verify(this.response).sendError(403, "rtfFrontend.convertHtml.invalidCsrfToken");
        verify(this.tokenService).isTokenValid(wrongToken);
        assertEquals("", result.getElementsByTag("body").text());
    }
}
      htmlConverterUrl: new XWiki.Document('ConvertHTML', 'RTFrontend').getURL('get', $.param({
        'xpage': 'plain',
        'outputSyntax': 'plain',
        'form_token': document.documentElement.dataset.xwikiFormToken
      })),