CVE-2022-41931

Eval Injection in xwiki-platform-icon-ui

• CVSS 8.8
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• Input Validation and Sanitization
• Remote

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

CVE

CVE-2022-41931

CWE

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVSS base score

8.8

Published

2022-11-23

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to XWiki version 13.10.7, 14.5, or 14.4.2.

def execute_user_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    eval(user_input)

user_input = "__import__('os').system('ls')"
execute_user_code(user_input)

import re
import ast

def execute_user_code(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = re.sub(r'[^a-zA-Z0-9_]', '', user_input)
    
    allowed_commands = ['function1', 'function2']
    if sanitized_input in allowed_commands:
        return execute_command(sanitized_input)
    else:
        raise ValueError("Invalid command")

def execute_command(command):
    """Secure function that fixes the vulnerability."""
    try:
        result = ast.literal_eval(f'"{command}"')
        return f"Executing {result}"
    except (ValueError, SyntaxError) as e:
        raise ValueError(f"Invalid input detected: {e}")

try:
    user_input = "__import__('os').system('ls')"
    result = execute_user_code(user_input)
    print(result)
except ValueError as e:
    print(e)

@misc{vaitp:cve202241931,
  title        = {{Eval Injection in xwiki-platform-icon-ui}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-41931},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-41931/}}
}