CVE-2023-26477

XWiki Platform allows arbitrary script injection via newThemeName parameter

• CVSS 9.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.

CVE

CVE-2023-26477

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

9.8

Published

2023-03-02

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki Platform to version 13.10.10, 14.9-rc-1, or 14.4.6.

from flask import Flask, request

app = Flask(__name__)

@app.route('/set_theme', methods=['POST'])
def set_theme():
    """Vulnerable function that demonstrates the security issue."""
    new_theme_name = request.form.get('newThemeName')
    
    execute_theme_change(new_theme_name)

def execute_theme_change(theme_name):
    """Vulnerable function that demonstrates the security issue."""
    eval(theme_name)

if __name__ == '__main__':
    app.run()

from flask import Flask, request
import ast

app = Flask(__name__)

@app.route('/set_theme', methods=['POST'])
def set_theme():
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    new_theme_name = request.form.get('newThemeName')
    
    execute_theme_change(new_theme_name)

def execute_theme_change(theme_name):
    """Secure function that fixes the vulnerability."""
    ast.literal_eval(theme_name)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202326477,
  title        = {{XWiki Platform allows arbitrary script injection via newThemeName parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-26477},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-26477/}}
}