CVE-2023-29518

XWiki Platform allows arbitrary code execution due to improper escaping in Invitation.InvitationCommon

• CVSS 8.8
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Authentication, Authorization, and Session Management
• Remote

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Invitation.InvitationCommon`. This page is installed by default. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue.

CVE

CVE-2023-29518

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

8.8

Published

2023-04-19

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to XWiki version 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11.

def execute_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    exec(user_input)

user_code = "print('Executing arbitrary code!')"
execute_code(user_code)

def execute_code(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = sanitize(user_input)
    
    try:
        exec(sanitized_input, {"__builtins__": {}})
    except Exception as e:
        print(f"Error executing code: {e}")

def sanitize(input_code):
    """Secure function that fixes the vulnerability."""
    forbidden_keywords = ['import', 'exec', 'eval', '__']
    for keyword in forbidden_keywords:
        if keyword in input_code:
            raise ValueError(f"Forbidden keyword detected: {keyword}")
    return input_code

@misc{vaitp:cve202329518,
  title        = {{XWiki Platform allows arbitrary code execution due to improper escaping in Invitation.InvitationCommon}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29518},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29518/}}
}