XWiki Platform may allow privilege escalation to programming rights via user's first name
Critical severity
GitHub Reviewed
Published
Mar 1, 2023
in
xwiki/xwiki-commons
•
Updated Mar 3, 2023
Package
Affected versions
>= 3.1-milestone-1, < 13.10.9
>= 14.0-rc-1, < 14.4.4
>= 14.5, < 14.7-rc-1
Patched versions
13.10.9
14.4.4
14.7-rc-1
Description
Published by the National Vulnerability Database
Mar 2, 2023
Published to the GitHub Advisory Database
Mar 3, 2023
Reviewed
Mar 3, 2023
Last updated
Mar 3, 2023
Impact
Any user can edit his own profile and inject code which is going to be executed with programming right.
Steps to reproduce:
The first name appears as interpreted "
Hello from groovy" instead of the expected fully escaped "{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}".The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.
Patches
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
Workarounds
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.
References
For more information
If you have any questions or comments about this advisory:
References