CVE-2022-36093 (published 2022-09-08T18:15Z)

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. Users can also be created when an external authentication system like LDAP is configured, but authentication fails unless the authentication system supports a bypass/local accounts are enabled in addition to the external authentication system. This issue has been patched in XWiki 13.10.5 and 14.3RC1. As a workaround, one may replace `xpart.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Michael Hamann
author_date: 2022-03-31 16:26:57+02:00
msg: XWIKI-19558: Only load vm templates in xpart.vm

* Add a page test for xpart.vm.
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: xpart.vm
change_type: ModificationType.MODIFY
diff: @@ -22,4 +22,9 @@
 #if ($request.useLayoutVars == 'true')
 #template('layoutvars.vm')
 #end
-#template($vm)
\ No newline at end of file
+#if ($vm.endsWith('.vm'))
+#template($vm)
+#else
+#set ($discard = $response.setStatus(400))
+Invalid template.
+#end
\ No newline at end of file

programming_language: R
filename: XPartPageTest.java
change_type: ModificationType.ADD
diff: @@ -0,0 +1,67 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.web;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xwiki.template.TemplateManager;
+import org.xwiki.test.page.PageTest;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Tests the {@code xpart.vm} template.
+ *
+ * @version $Id$
+ * @since 14.3RC1
+ * @since 13.10.5
+ */
+class XPartPageTest extends PageTest
+{
+    private static final String X_PART_VM = "xpart.vm";
+
+    private static final String VM_PARAMETER = "vm";
+
+    private TemplateManager templateManager;
+
+    @BeforeEach
+    void setUp() throws Exception
+    {
+        this.templateManager = this.componentManager.getInstance(TemplateManager.class);
+        this.request.put("xpage", "xpart");
+    }
+
+    @Test
+    void renderRegisterTemplate() throws Exception
+    {
+        this.request.put(VM_PARAMETER, "register.vm");
+        String result = this.templateManager.render(X_PART_VM);
+        assertTrue(result.contains("<form id=\"register\""));
+    }
+
+    @Test
+    void renderForbiddenTemplate() throws Exception
+    {
+        this.request.put(VM_PARAMETER, "distribution/firstadminuser.wiki");
+        String result = this.templateManager.render(X_PART_VM);
+        assertEquals("Invalid template.", result.trim());
+    }
+}

programming_language: Java