Skip to content

Async and display macro allow displaying and interacting with any document in restricted mode

Critical
tmortagne published GHSA-gpq5-7p34-vqx5 Apr 18, 2023

Package

maven org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-rendering-async-macro (Maven)

Affected versions

>= 10.11.1, >= 11.10

Patched versions

15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11

Description

Impact

It's possible to display any page you cannot access through the combination of the async and display macro.

Steps to reproduce:

  1. Enable comments for guests by giving guests comment rights
  2. As a guest, create a comment with content {{async}}{{display reference="Menu.WebHome" /}}{{/async}}
  3. Open the comments viewer from the menu (appends ?viewer=comments to the URL)

-> the Menu.WebHome is displayed while the expectation would be to have an error that the current user is not allowed to see it

Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11.

Workarounds

There is no known workaround.

References

https://jira.xwiki.org/browse/XWIKI-20394
https://jira.xwiki.org/browse/XRENDERING-694

For more information

If you have any questions or comments about this advisory:

Severity

Critical
9.9
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE ID

CVE-2023-29526

Weaknesses