CVE-2023-29511 (published 2023-04-16T08:15Z)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-95
cwe_name: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
extended_description: This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Manuel Leduc
author_date: 2022-11-29 14:56:36+01:00
msg: XWIKI-20261: Improved escaping of AdminFieldsDisplaySheet
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: pom.xml
change_type: ModificationType.MODIFY
diff: @@ -91,6 +91,27 @@
       <artifactId>bootstrap-select</artifactId>
       <scope>runtime</scope>
     </dependency>
+    <!-- Test dependencies. -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-page</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.commons</groupId>
+      <artifactId>xwiki-commons-script</artifactId>
+      <version>${commons.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <!-- Provides the component list for RenderingScriptService. -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
   <build>
     <plugins>

programming_language: HTML
filename: AdminFieldsDisplaySheet.xml
change_type: ModificationType.MODIFY
diff: @@ -116,11 +116,14 @@
     #set($configClassName = 'XWiki.XWikiPreferences')
     #set($formId = $section.toLowerCase())
   #end
-  &lt;form id="$formId" method="post" action="$xwiki.getURL($configDoc, 'saveandcontinue')" onsubmit="cancelCancelEdit()" class="xform"&gt;
+  &lt;form id="$escapetool.xml($formId)" method="post"
+      action="$escapetool.xml($xwiki.getURL($configDoc, 'saveandcontinue'))"
+      onsubmit="cancelCancelEdit()"
+      class="xform"&gt;
     #set($obj = $configDoc.getObject($configClassName))
     #foreach ($entry in $params.entrySet())
       #set ($fields = $entry.value)
-      &lt;fieldset class="$entry.key"&gt;
+      &lt;fieldset class="$escapetool.xml($entry.key)"&gt;
       ## If there is only one section, don't display the legend
       #if ($params.size() &gt; 1)
         &lt;legend&gt;$services.localization.render("admin.$entry.key")&lt;/legend&gt;
@@ -145,7 +148,7 @@
       &lt;input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /&gt;
       &lt;input type="hidden" name="xcontinue" value="$xwiki.getURL($currentDoc, 'admin', "editor=${escapetool.url(${editor})}&amp;amp;section=${escapetool.url(${section})}&amp;amp;space=${escapetool.url(${currentSpace})}")" /&gt;
       &lt;input type="hidden" name="xredirect" value="$xwiki.getURL($currentDoc, 'admin', "editor=${escapetool.url(${editor})}&amp;amp;section=${escapetool.url(${section})}&amp;amp;space=${escapetool.url(${currentSpace})}")" /&gt;
-      &lt;input type="hidden" name="classname" value="$configClassName" /&gt;
+      &lt;input type="hidden" name="classname" value="$escapetool.xml($configClassName)" /&gt;
       #if ("$!objectPolicy" != '')
       &lt;input type="hidden" name="objectPolicy" value="$escapetool.xml($objectPolicy)" /&gt;
       #end

programming_language: PHP
filename: AdminFieldsDisplaySheetPageTest.java
change_type: ModificationType.ADD
diff: @@ -0,0 +1,99 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.administration;
+
+import java.util.Map;
+
+import javax.script.ScriptContext;
+
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.Element;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xwiki.model.reference.DocumentReference;
+import org.xwiki.rendering.RenderingScriptServiceComponentList;
+import org.xwiki.rendering.internal.configuration.DefaultExtendedRenderingConfiguration;
+import org.xwiki.rendering.internal.configuration.RenderingConfigClassDocumentConfigurationSource;
+import org.xwiki.script.ScriptContextManager;
+import org.xwiki.test.annotation.ComponentList;
+import org.xwiki.test.page.HTML50ComponentList;
+import org.xwiki.test.page.PageTest;
+import org.xwiki.test.page.TestNoScriptMacro;
+import org.xwiki.test.page.XWikiSyntax21ComponentList;
+
+import static java.util.Collections.emptyList;
+import static java.util.Collections.singletonMap;
+import static javax.script.ScriptContext.ENGINE_SCOPE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Page test of {@code XWiki.AdminFieldsDisplaySheet}.
+ *
+ * @version $Id$
+ * @since 15.0RC1
+ * @since 14.10.1
+ * @since 14.4.8
+ * @since 13.10.11
+ */
+@HTML50ComponentList
+@XWikiSyntax21ComponentList
+@RenderingScriptServiceComponentList
+@ComponentList({
+    TestNoScriptMacro.class,
+    DefaultExtendedRenderingConfiguration.class,
+    RenderingConfigClassDocumentConfigurationSource.class
+})
+class AdminFieldsDisplaySheetPageTest extends PageTest
+{
+    private ScriptContext scriptContext;
+
+    @BeforeEach
+    void setUp() throws Exception
+    {
+        this.scriptContext =
+            this.oldcore.getMocker().<ScriptContextManager>getInstance(ScriptContextManager.class).getScriptContext();
+    }
+
+    @Test
+    void escaping() throws Exception
+    {
+        String paramsInput = "\"/><script>console.log('params');</script>{{/html}}{{noscript/}}";
+        String sectionInput = "\"/><strong>console.log('section');</script>{{/html}}{{noscript/}}";
+        String paramClassInput = "\"/><script>console.log('paramClass');</script>{{/html}}{{noscript/}}";
+        Map<Object, Object> params = singletonMap(paramsInput, emptyList());
+        DocumentReference otherDocumentReference = new DocumentReference("xwiki", "Space", "Page");
+        com.xpn.xwiki.api.Document otherDocument =
+            new com.xpn.xwiki.api.Document(this.xwiki.getDocument(otherDocumentReference, this.context), this.context);
+
+        this.scriptContext.setAttribute("section", sectionInput, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("paramDoc", otherDocument, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("params", params, ENGINE_SCOPE);
+        this.scriptContext.setAttribute("paramClass", paramClassInput, ENGINE_SCOPE);
+
+        Document document = renderHTMLPage(new DocumentReference("xwiki", "XWiki", "AdminFieldsDisplaySheet"));
+
+        Element form = document.selectFirst("form");
+        assertEquals(String.format("%s_%s", sectionInput, paramClassInput), form.attr("id"));
+        assertEquals("/xwiki/bin/saveandcontinue/Space/Page", form.attr("action"));
+        Element fieldset = form.selectFirst("fieldset");
+        assertEquals(paramsInput, fieldset.attr("class"));
+        assertEquals(paramClassInput, document.selectFirst(".hidden input[name='classname']").val());
+    }
+}

programming_language: Java