CVE-2021-32620 (published 2021-05-28T21:15Z)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Simon Urli
author_date: 2020-12-16 15:43:13+01:00
msg: XWIKI-17942: Email validation check is not properly reset

  * Ensure to reset the validation email key once validated
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: XWiki.java
change_type: ModificationType.MODIFY
diff: @@ -3857,10 +3857,14 @@ public int validateUser(boolean withConfirmEmail, XWikiContext context) throws X
 
             // Compare the two keys
             if ((!storedKey.equals("") && (storedKey.equals(validationKey)))) {
+                // Ensure to remove the validation key value, so it cannot be used afterwards to enable back
+                // a disabled user.
+                userObject.setStringValue("validkey", "");
+                saveDocument(userDocument, context);
+
                 XWikiUser xWikiUser = new XWikiUser(userDocument.getDocumentReference());
                 xWikiUser.setDisabled(false, context);
                 xWikiUser.setEmailChecked(true, context);
-                saveDocument(userDocument, context);
 
                 if (withConfirmEmail) {
                     String email = userObject.getStringValue("email");

programming_language: Java
filename: XWikiTest.java
change_type: ModificationType.MODIFY
diff: @@ -580,6 +580,8 @@ public void testValidationKeyStorage() throws Exception
         this.xwiki.saveDocument(testUser, context);
 
         assertEquals(0, this.xwiki.validateUser(false, this.oldcore.getXWikiContext()));
+        XWikiDocument reloadedDocument = this.xwiki.getDocument(testUser, context);
+        assertEquals("", reloadedDocument.getObject("XWiki.XWikiUsers").getStringValue("validkey"));
 
         // Check with an incorrect plaintext key
         validationKey.setValue("wrong key");

programming_language: Java