CVE-2022-23615 (published 2022-02-09T21:15Z)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Thomas Mortagne
author_date: 2021-01-19 09:28:28+01:00
msg: XWIKI-5024: Document potentially saved with the wrong author
* add an configuration off switch
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: Document.java
change_type: ModificationType.MODIFY
diff: @@ -37,6 +37,7 @@
 import org.suigeneris.jrcs.diff.DifferentiationFailedException;
 import org.suigeneris.jrcs.diff.delta.Delta;
 import org.suigeneris.jrcs.rcs.Version;
+import org.xwiki.configuration.ConfigurationSource;
 import org.xwiki.context.Execution;
 import org.xwiki.context.ExecutionContext;
 import org.xwiki.display.internal.DocumentDisplayerParameters;
@@ -69,6 +70,7 @@
 import com.xpn.xwiki.doc.XWikiDocumentArchive;
 import com.xpn.xwiki.doc.XWikiLink;
 import com.xpn.xwiki.doc.XWikiLock;
+import com.xpn.xwiki.internal.XWikiCfgConfigurationSource;
 import com.xpn.xwiki.objects.BaseObject;
 import com.xpn.xwiki.objects.BaseProperty;
 import com.xpn.xwiki.objects.ObjectDiff;
@@ -132,6 +134,8 @@ public class Document extends Api
 
     private DocumentRevisionProvider documentRevisionProvider;
 
+    private ConfigurationSource configuration;
+
     private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
     {
         if (this.currentMixedDocumentReferenceResolver == null) {
@@ -179,6 +183,15 @@ private DocumentRevisionProvider getDocumentRevisionProvider()
         return this.documentRevisionProvider;
     }
 
+    private ConfigurationSource getConfiguration()
+    {
+        if (this.configuration == null) {
+            this.configuration = Utils.getComponent(ConfigurationSource.class);
+        }
+
+        return this.configuration;
+    }
+
     /**
      * Document constructor.
      *
@@ -2537,7 +2550,7 @@ public void save(String comment, boolean minorEdit) throws XWikiException
         if (hasAccessLevel("edit")) {
             // If the current author does not have PR don't let it set current user as author of the saved document
             // since it can lead to right escalation
-            if (hasProgrammingRights()) {
+            if (hasProgrammingRights() || !getConfiguration().getProperty("security.script.save.checkAuthor", true)) {
                 saveDocument(comment, minorEdit);
             } else {
                 saveAsAuthor(comment, minorEdit);

programming_language: Java
filename: xwiki.properties.vm
change_type: ModificationType.MODIFY
diff: @@ -664,6 +664,13 @@ extension.versioncheck.environment.enabled=$xwikiPropertiesEnvironmentVersionChe
 #-# The default is:
 # security.authorization.settler=default
 
+#-# [Since 13.0]
+#-# Control if document save API should also check the right of the script author when saving a document.
+#-# When false only the current user right is checked.
+#-#
+#-# The default is:
+# security.script.save.checkAuthor=true
+
 #-------------------------------------------------------------------------------------
 # URL
 #-------------------------------------------------------------------------------------
@@ -1185,4 +1192,4 @@ edit.defaultEditor.org.xwiki.rendering.block.XDOM#wysiwyg=$xwikiPropertiesDefaul
 #-# The default value is:
 # skinx.jsStrictModeEnabled = false
 
-$!xwikiPropertiesAdditionalProperties
\ No newline at end of file
+$!xwikiPropertiesAdditionalProperties

programming_language: Ruby