CVE-2023-27479

XWiki Platform View Rights Code Execution

• CVSS 9.9
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Input Validation and Sanitization
• Remote

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters. A proof of concept exploit is to log in, add an `XWiki.UIExtensionClass` xobject to the user profile page, with an Extension Parameters content containing `label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}`. Then, navigating to `PanelsCode.ApplicationsPanelConfigurationSheet` (i.e., `<xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet` where `<xwiki-host>` is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see `Hello from groovy!` displayed on the screen. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. For users unable to upgrade the issue can be fixed by editing the `PanelsCode.ApplicationsPanelConfigurationSheet` wiki page and making the same modifications as shown in commit `6de5442f3c`.

CVE

CVE-2023-27479

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

9.9

Published

2023-03-07

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade to XWiki 13.10.11, 14.4.7, or 14.10-rc-1.

def execute_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    eval(user_input)

user_input = '{{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}'

execute_code(user_input)

import ast

def execute_code(user_input):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    try:
        ast.literal_eval(user_input)
    except (SyntaxError, ValueError) as e:
        print(f"Error evaluating string: {e}")
    

user_input = '{{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}'
execute_code(user_input)

@misc{vaitp:cve202327479,
  title        = {{XWiki Platform View Rights Code Execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-27479},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-27479/}}
}