CVE-2022-36100

XWiki Tags Code Execution, No Rights Required

• CVSS 8.8
• CWE-116
• Input Validation and Sanitization
• Remote

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document `Main.Tags` in XWiki didn't sanitize user inputs properly. This allowed users with view rights on the document (default in a public wiki or for authenticated users on private wikis) to execute arbitrary Groovy, Python and Velocity code with programming rights. This also allowed bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. The vulnerability could be used to impact the availability of the wiki. On XWiki versions before 13.10.4 and 14.2, this can be combined with CVE-2022-36092, meaning that no rights are required to perform the attack. The vulnerability has been patched in versions 13.10.6 and 14.4. As a workaround, the patch that fixes the issue can be manually applied to the document `Main.Tags` or the updated version of that document can be imported from version 14.4 of xwiki-platform-tag-ui using the import feature in the administration UI on XWiki 10.9 and later.

CVE

CVE-2022-36100

CWE

CWE-116

CVSS base score

8.8

Published

2022-09-08

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to XWiki versions 13.10.6 or 14.4.

def execute_user_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    try:
        exec(user_input)
    except Exception as e:
        print(f"Error executing code: {e}")

user_input = "__import__('os').system('rm -rf /')"
execute_user_code(user_input)

import re

# ? Blacklisted patterns
BLACKLISTED_PATTERNS = [
    r"import",         # module importing
    r"__.*?__",        # dunder methods: __import__, __globals__, etc.
    r"os",             # system module
    r"sys",            # system module
    r"eval",           # code execution
    r"exec",           # code execution
    r"open",           # file access
    r"subprocess",     # external commands
    r"globals",        # accessing full context
    r"locals",         # same as above
]

def is_blacklisted(code):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    for pattern in BLACKLISTED_PATTERNS:
        if re.search(pattern, code, re.IGNORECASE):
            return True
    return False

def execute_user_code(user_input):
    """Secure function that fixes the vulnerability."""
    if is_blacklisted(user_input):
        print("Blocked: Input contains forbidden patterns.")
        return

    try:
        exec(user_input)
    except Exception as e:
        print(f"Execution error: {e}")

user_input = "__import__('os').system('echo hacked')"
execute_user_code(user_input)

@misc{vaitp:cve202236100,
  title        = {{XWiki Tags Code Execution, No Rights Required}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36100},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36100/}}
}