CVE-2023-29511 (XML, published 2023-04-16T08:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-95 \u2014 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/pom.xml
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminFieldsDisplaySheet.xml
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/AdminFieldsDisplaySheetPageTest.java
Commit message: XWIKI-20261: Improved escaping of AdminFieldsDisplaySheet


Vulnerable code:
  &lt;form id="$formId" method="post" action="$xwiki.getURL($configDoc, 'saveandcontinue')" onsubmit="cancelCancelEdit()" class="xform"&gt;
      &lt;fieldset class="$entry.key"&gt;
      &lt;input type="hidden" name="classname" value="$configClassName" /&gt;

Fixed code:
    <!-- Test dependencies. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-page</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.commons</groupId>
      <artifactId>xwiki-commons-script</artifactId>
      <version>${commons.version}</version>
      <scope>test</scope>
    </dependency>
    <!-- Provides the component list for RenderingScriptService. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
      <version>${project.version}</version>
      <type>test-jar</type>
      <scope>test</scope>
    </dependency>
  &lt;form id="$escapetool.xml($formId)" method="post"
      action="$escapetool.xml($xwiki.getURL($configDoc, 'saveandcontinue'))"
      onsubmit="cancelCancelEdit()"
      class="xform"&gt;
      &lt;fieldset class="$escapetool.xml($entry.key)"&gt;
      &lt;input type="hidden" name="classname" value="$escapetool.xml($configClassName)" /&gt;
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.administration;

import java.util.Map;

import javax.script.ScriptContext;

import org.jsoup.nodes.Document;
import org.jsoup.nodes.Element;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.xwiki.model.reference.DocumentReference;
import org.xwiki.rendering.RenderingScriptServiceComponentList;
import org.xwiki.rendering.internal.configuration.DefaultExtendedRenderingConfiguration;
import org.xwiki.rendering.internal.configuration.RenderingConfigClassDocumentConfigurationSource;
import org.xwiki.script.ScriptContextManager;
import org.xwiki.test.annotation.ComponentList;
import org.xwiki.test.page.HTML50ComponentList;
import org.xwiki.test.page.PageTest;
import org.xwiki.test.page.TestNoScriptMacro;
import org.xwiki.test.page.XWikiSyntax21ComponentList;

import static java.util.Collections.emptyList;
import static java.util.Collections.singletonMap;
import static javax.script.ScriptContext.ENGINE_SCOPE;
import static org.junit.jupiter.api.Assertions.assertEquals;

/**
 * Page test of {@code XWiki.AdminFieldsDisplaySheet}.
 *
 * @version $Id$
 * @since 15.0RC1
 * @since 14.10.1
 * @since 14.4.8
 * @since 13.10.11
 */
@HTML50ComponentList
@XWikiSyntax21ComponentList
@RenderingScriptServiceComponentList
@ComponentList({
    TestNoScriptMacro.class,
    DefaultExtendedRenderingConfiguration.class,
    RenderingConfigClassDocumentConfigurationSource.class
})
class AdminFieldsDisplaySheetPageTest extends PageTest
{
    private ScriptContext scriptContext;

    @BeforeEach
    void setUp() throws Exception
    {
        this.scriptContext =
            this.oldcore.getMocker().<ScriptContextManager>getInstance(ScriptContextManager.class).getScriptContext();
    }

    @Test
    void escaping() throws Exception
    {
        String paramsInput = "\"/><script>console.log('params');</script>{{/html}}{{noscript/}}";
        String sectionInput = "\"/><strong>console.log('section');</script>{{/html}}{{noscript/}}";
        String paramClassInput = "\"/><script>console.log('paramClass');</script>{{/html}}{{noscript/}}";
        Map<Object, Object> params = singletonMap(paramsInput, emptyList());
        DocumentReference otherDocumentReference = new DocumentReference("xwiki", "Space", "Page");
        com.xpn.xwiki.api.Document otherDocument =
            new com.xpn.xwiki.api.Document(this.xwiki.getDocument(otherDocumentReference, this.context), this.context);

        this.scriptContext.setAttribute("section", sectionInput, ENGINE_SCOPE);
        this.scriptContext.setAttribute("paramDoc", otherDocument, ENGINE_SCOPE);
        this.scriptContext.setAttribute("params", params, ENGINE_SCOPE);
        this.scriptContext.setAttribute("paramClass", paramClassInput, ENGINE_SCOPE);

        Document document = renderHTMLPage(new DocumentReference("xwiki", "XWiki", "AdminFieldsDisplaySheet"));

        Element form = document.selectFirst("form");
        assertEquals(String.format("%s_%s", sectionInput, paramClassInput), form.attr("id"));
        assertEquals("/xwiki/bin/saveandcontinue/Space/Page", form.attr("action"));
        Element fieldset = form.selectFirst("fieldset");
        assertEquals(paramsInput, fieldset.attr("class"));
        assertEquals(paramClassInput, document.selectFirst(".hidden input[name='classname']").val());
    }
}