CVE-2023-29521

XWiki Platform allows arbitrary code execution via unescaped Macro.VFSTreeMacro

• CVSS 8.8
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Input Validation and Sanitization
• Remote

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2023-29521

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

8.8

Published

2023-04-19

OWASP

A03 Injection

Orthogonal defect classification

Assignment

Code defect classification

Incorrect Assignment

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 15.0-rc-1, 14.10.2, 14.4.8, or 13.10.11 to fix the vulnerability.

def execute_code(user_input):
    """Vulnerable function that demonstrates the security issue."""
    exec(user_input)

user_code = "os.system('echo Vulnerable!')"
execute_code(user_code)

def execute_code(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = escape_user_input(user_input)
    
    exec_context = {}
    
    try:
        exec(sanitized_input, exec_context)
    except Exception as e:
        print(f"Error executing code: {e}")

def escape_user_input(input_code):
    """Secure function that fixes the vulnerability."""
    dangerous_chars = [';', 'import', 'exec', 'eval', '__', 'os', 'sys']
    for char in dangerous_chars:
        input_code = input_code.replace(char, '')
    return input_code

user_code = "os.system('echo Vulnerable!')"
execute_code(user_code)

@misc{vaitp:cve202329521,
  title        = {{XWiki Platform allows arbitrary code execution via unescaped Macro.VFSTreeMacro}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-29521},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-29521/}}
}