CVE-2023-29210

XWiki Commons: Code Execution via Macro Parameter Vulnerability

• CVSS 8.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

CVE

CVE-2023-29210

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.8

Published

2023-04-15

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 13.10.11, 14.4.7, or 14.10.

def execute_user_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    exec(user_input)

user_input = "__import__('os').system('rm -rf /')"
execute_user_code(user_input)

import ast

ALLOWED_FUNCTIONS = {
    "print": print
}

def execute_user_code(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = sanitize(user_input)
    execute_in_context(sanitized_input)

def sanitize(user_input):
    """Secure function that fixes the vulnerability."""
    for func in ALLOWED_FUNCTIONS:
        if func not in user_input:
            raise ValueError(f"Function '{func}' is not allowed.")
    return user_input

def execute_in_context(code):
    """Secure function that fixes the vulnerability."""
    try:
        ast.literal_eval(code)
    except ValueError:
        if code.startswith("print("):
            print(code[6:-1])
        else:
            raise ValueError("Unsafe code detected")

user_input = "__import__('os').system('rm -rf /')"
execute_user_code(user_input)

@misc{vaitp:cve202329210,
  title        = {{XWiki Commons: Code Execution via Macro Parameter Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29210},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29210/}}
}