Skip to content

Unprivileged users can make arbitrary select queries using DatabaseListProperty and suggest.vm

Moderate
tmortagne published GHSA-vpx4-7rfp-h545 Mar 1, 2023

Package

maven org.xwiki.platform:xwiki-platform-web (Maven)

Affected versions

>=1.3-rc-1

Patched versions

13.10.11, 14.4.7, 14.10

Description

Impact

Any user with edit right can execute arbitrary database select and access data stored in the database.

To reproduce:

  • In admin, rights, remove scripting rights for {{XWikiAllGroup}}.
  • Create a new user without any special privileges.
  • Create a page "Private.WebHome" with {{TOKEN_42}} as content. Go to "page administration" and explicitly set all rights for "Admin" to remove them for all other users.
  • Logout and login as the unprivileged user. Ensure that the previously created page cannot be viewed.
  • Create a new page "ExploitClass.WebHome" and then open it in the class editor (first, make the user an advanced user).
  • Add a field named {{ContentList}} of type {{Database List}}
  • Enter in field "Hibernate Query" the following content: {noformat}select doc.content, doc.fullName from XWikiDocument as doc where doc.fullName = 'Private.WebHome'{noformat}
  • Save the class.
  • Open [http://localhost:8080/xwiki/bin/view/ExploitClass/?xpage=suggest&classname=ExploitClass.WebHome&fieldname=ContentList&firCol=doc.fullName&secCol=-]

Patches

The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Workarounds

There is no workaround for this vulnerability other than upgrading.

References

https://jira.xwiki.org/browse/XWIKI-19523

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
6.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE ID

CVE-2023-26473

Weaknesses