Skip to content

Privilege escalation via properties with wiki syntax that are executed with the wrong author

Critical
tmortagne published GHSA-3738-p9x3-mv9r Mar 1, 2023

Package

maven org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-legacy-oldcore (Maven)

Affected versions

>= 13.10

Patched versions

13.10.11, 14.4.7, 14.10

Description

Impact

It's possible to use the right of an existing document content author to execute a text area property.

To reproduce:

  • As an admin with programming rights, create a new user without script or programming right.
  • Login with the freshly created user.
  • Insert the following text in source mode in the about section:
    {{groovy}}println("hello from groovy!"){{/groovy}}
  • Click "Save & View"

Patches

This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

Workarounds

No known workaround.

References

https://jira.xwiki.org/browse/XWIKI-20373

For more information

If you have any questions or comments about this advisory:

Severity

Critical
9.9
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE ID

CVE-2023-26474

Weaknesses