CVE-2023-29211

XWiki Commons allows code execution via improper escaping in wikiId parameter

• CVSS 8.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

CVE

CVE-2023-29211

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.8

Published

2023-04-16

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 13.10.11, 14.4.7, or 14.10.

from flask import Flask, request

app = Flask(__name__)

@app.route('/delete_wiki', methods=['POST'])
def delete_wiki():
    wiki_id = request.args.get('wikiId')

    delete_wiki_logic(wiki_id)

    return 'Wiki deletion initiated.', 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort
import re

app = Flask(__name__)

def is_valid_wiki_id(wiki_id):
    return re.match(r'^[a-zA-Z0-9_]+$', wiki_id) is not None

@app.route('/delete_wiki', methods=['POST'])
def delete_wiki():
    wiki_id = request.args.get('wikiId')
    
    if not wiki_id or not is_valid_wiki_id(wiki_id):
        abort(400, 'Invalid wikiId parameter.')

    delete_wiki_logic(wiki_id)

    return 'Wiki deleted successfully.', 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202329211,
  title        = {{XWiki Commons allows code execution via improper escaping in wikiId parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29211},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29211/}}
}