CVE-2023-29212

Code execution via unescaped included pages in XWiki Commons

• CVSS 8.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.

CVE

CVE-2023-29212

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.8

Published

2023-04-16

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to XWiki version 14.4.7 or 14.10.

def include_page(page_name):
    """Vulnerable function that demonstrates the security issue."""
    eval(f"include('{page_name}')")

user_input = "${groovy: System.getProperty('user.home')}"
include_page(user_input)

import ast

def modified_include(page_name):
    """Secure function that fixes the vulnerability."""
    modified_page_name = escape(page_name)
    include_page(modified_page_name)

def escape(input_string):
    """Secure function that fixes the vulnerability."""
    return input_string.replace("<", "<").replace(">", ">").replace("${", "${'${'}").replace("#", "#")

def include_page(page_name):
    """Secure function that fixes the vulnerability."""
    try:
        page_name_literal = ast.literal_eval(f"'{page_name}'")
        
        allowed_pages = {"home": "home.html", "about": "about.html", "contact": "contact.html"}

        if page_name_literal not in allowed_pages:
            raise ValueError("Invalid page name")

        with open(allowed_pages[page_name_literal], 'r') as f:
            print(f.read())
    
    except (ValueError, SyntaxError) as e:
        print(f"Error: {e}")

user_input = "home"
modified_include(user_input)

@misc{vaitp:cve202329212,
  title        = {{Code execution via unescaped included pages in XWiki Commons}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29212},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29212/}}
}