CVE-2023-37462
XWiki Platform injection vulnerability in SkinsCode.XWikiSkinsSheet
- CVSS 8.8
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Input Validation and Sanitization
- Remote
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.
- CVSS base score
- 8.8
- Published
- 2023-07-14
- OWASP
- A03 Injection
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Direct Object References (IDOR)
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update to XWiki 14.4.8, 14.10.4, or 15.0-rc-1.
Vulnerable code sample
def render_page(input_data):
"""Vulnerable function that demonstrates the security issue."""
return f"<html><body>{input_data}</body></html>"
payload = "<script>alert('Vulnerable!');</script>"
output = render_page(payload)
print(output)Patched code sample
def render_page(input_data):
"""Secure function that fixes the vulnerability."""
escaped_data = escape(input_data)
return render(escaped_data)
def escape(data):
"""Secure function that fixes the vulnerability."""
return data.replace("<", "<").replace(">", ">").replace("&", "&")
def render(content):
"""Secure function that fixes the vulnerability."""
return f"<html><body>{content}</body></html>"
payload = "<script>alert('Vulnerable!');</script>"
output = render_page(payload)
print(output)Cite this entry
@misc{vaitp:cve202337462,
title = {{XWiki Platform injection vulnerability in SkinsCode.XWikiSkinsSheet}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-37462},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-37462/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::