CVE-2022-36092 (Java, published 2022-09-08T18:15Z)
Description: value: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginAction.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginErrorAction.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginSubmitAction.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java
Commit message: XWIKI-19549: Disallow template override for login, register and skin

* Also do not put a document without view rights into the context.


Vulnerable code:
        context.put("doc", doc);
        context.put("cdoc", doc);
        vcontext.put("doc", doc.newDocument(context));
        vcontext.put("cdoc", vcontext.get("doc"));
        XWikiDocument tdoc;

        // If the parameter language exists and is empty, it means we want to force loading the regular document
        // not a translation. This should be handled later by doing a better separation between locale used in the UI
        // and for loading the documents.
        if ("".equals(context.getRequest().getParameter("language"))) {
            tdoc = doc;
            tdoc = doc.getTranslatedDocument(context);
        }
        try {
            String rev = (String) context.get("rev");
            if (StringUtils.isNotEmpty(rev)) {
                tdoc = getDocument(tdoc, rev, context);
        } catch (Exception ex) {
            // Invalid version, just use the most recent one
        context.put("tdoc", tdoc);
        vcontext.put("tdoc", tdoc.newDocument(context));
        return "login";
        return "login";
        return "login";
            return "docdoesnotexist";
            return "docdoesnotexist";

Fixed code:
        if (!"skin".equals(context.getAction()) && !this.getRightService().hasAccessLevel("view",
            user.getFullName(), doc.getFullName(), context)) {
            // If for some reason (e.g., login action) the user has rights for the action but no view right on the
            // document, do not load the document into the context.
            setPhonyDocument(reference, context, vcontext);
            doc = context.getDoc();
            context.put("tdoc", doc);
            context.put("cdoc", doc);
            context.put("doc", doc);
            context.put("cdoc", doc);
            vcontext.put("doc", doc.newDocument(context));
            vcontext.put("cdoc", vcontext.get("doc"));
            XWikiDocument tdoc;

            // If the parameter language exists and is empty, it means we want to force loading the regular document
            // not a translation. This should be handled later by doing a better separation between locale used in the UI
            // and for loading the documents.
            if ("".equals(context.getRequest().getParameter("language"))) {
                tdoc = doc;
            } else {
                tdoc = doc.getTranslatedDocument(context);
            }
            try {
                String rev = (String) context.get("rev");
                if (StringUtils.isNotEmpty(rev)) {
                    tdoc = getDocument(tdoc, rev, context);
                }
            } catch (Exception ex) {
                // Invalid version, just use the most recent one
            context.put("tdoc", tdoc);
            vcontext.put("tdoc", tdoc.newDocument(context));
    private static final String LOGIN = "login";

    @Override
    public boolean action(XWikiContext context) throws XWikiException
    {
        // Disallow template override with xpage parameter.
        if (!LOGIN.equals(Utils.getPage(context.getRequest(), LOGIN))) {
            throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
                String.format("Template may not be overriden with 'xpage' in [%s] action.", LOGIN));
        }

        return super.action(context);
    }

        return LOGIN;
    private static final String LOGIN = "login";

    @Override
    public boolean action(XWikiContext context) throws XWikiException
    {
        // Disallow template override with xpage parameter.
        if (!LOGIN.equals(Utils.getPage(context.getRequest(), LOGIN))) {
            throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
                String.format("Template may not be overriden with 'xpage' in [%s] action.", LOGIN));
        }

        return super.action(context);
    }

        return LOGIN;
    private static final String LOGIN = "login";

    @Override
    public boolean action(XWikiContext context) throws XWikiException
    {
        // Disallow template override with xpage parameter.
        if (!LOGIN.equals(Utils.getPage(context.getRequest(), LOGIN))) {
            throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
                String.format("Template may not be overriden with 'xpage' in [%s] action.", LOGIN));
        }

        return super.action(context);
    }

        return LOGIN;
        // Disallow template override with xpage parameter.
        if (!REGISTER.equals(Utils.getPage(context.getRequest(), REGISTER))) {
            throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
                String.format("Template may not be overriden with 'xpage' in [%s] action.", REGISTER));
        }


    private static final String DOCDOESNOTEXIST = "docdoesnotexist";

    @Override
    public boolean action(XWikiContext context) throws XWikiException
    {
        // Disallow template override with xpage parameter.
        if (!DOCDOESNOTEXIST.equals(Utils.getPage(context.getRequest(), DOCDOESNOTEXIST))) {
            throw new XWikiException(XWikiException.MODULE_XWIKI, XWikiException.ERROR_XWIKI_ACCESS_DENIED,
                "Template may not be overriden with 'xpage' in [skin] action.");
        }

        return super.action(context);
    }

            return DOCDOESNOTEXIST;
            return DOCDOESNOTEXIST;