CVE-2023-29511

XWiki Platform allows code execution via improper section id escaping in XWiki.AdminFieldsDisplaySheet

• CVSS 8.8
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• Input Validation and Sanitization
• Remote

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

CVE

CVE-2023-29511

CWE

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVSS base score

8.8

Published

2023-04-16

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11.

def render_admin_fields_display_sheet(section_id):
    """Vulnerable function that demonstrates the security issue."""
    template = f"<div id='{section_id}'>Admin Fields Display</div>"
    return template

user_input_section_id = "<script>alert('XSS');</script>"
output = render_admin_fields_display_sheet(user_input_section_id)
print(output)

def escape_section_id(section_id):
    """Secure function that fixes the vulnerability."""
    return section_id.replace("<", "<").replace(">", ">").replace("&", "&")

def render_admin_fields_display_sheet(section_id):
    """Secure function that fixes the vulnerability."""
    modified_section_id = escape_section_id(section_id)
    template = f"<div id='{modified_section_id}'>Admin Fields Display</div>"
    return template

user_input_section_id = "<script>alert('XSS');</script>"
output = render_admin_fields_display_sheet(user_input_section_id)
print(output)

@misc{vaitp:cve202329511,
  title        = {{XWiki Platform allows code execution via improper section id escaping in XWiki.AdminFieldsDisplaySheet}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29511},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29511/}}
}