CVE-2023-29209

XWiki Commons Macro Parameter Escaping Vulnerability

• CVSS 8.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

CVE

CVE-2023-29209

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.8

Published

2023-04-15

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 13.10.11, 14.4.7, or 14.10.

def execute_macro(user_input):
    """Vulnerable function that demonstrates the security issue."""
    eval(user_input)

user_input = "<script>alert('XSS')</script>"
execute_macro(user_input)

import ast

def macro_execution(user_input):
    """Secure function that fixes the vulnerability."""
    escaped_input = escape(user_input)
    
    execute_macro(escaped_input)

def escape(input_string):
    """Secure function that fixes the vulnerability."""
    return input_string.replace('$', '\\$').replace('{', '\\{').replace('}', '\\}')

def execute_macro(escaped_input):
    """Secure function that fixes the vulnerability."""
    ast.literal_eval(escaped_input)

user_input = "<script>alert('XSS')</script>"
macro_execution(user_input)

@misc{vaitp:cve202329209,
  title        = {{XWiki Commons Macro Parameter Escaping Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29209},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29209/}}
}