CVE-2023-37909

XWiki Platform <=15.3-rc-1: Arbitrary script execution

• CVSS 8.8
• CWE-94
• Input Validation and Sanitization
• Remote

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed.

CVE

CVE-2023-37909

CWE

CWE-94

CVSS base score

8.8

Published

2023-10-25

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update XWiki to version 14.10.8 or 15.3-rc-1.

def execute_user_script(user_input):
    """Vulnerable function that demonstrates the security issue."""
    exec(user_input)

def edit_user_profile(user_id, script):
    """Vulnerable function that demonstrates the security issue."""
    execute_user_script(script)

user_input = "__import__('os').system('rm -rf /')"
edit_user_profile('user123', user_input)

def execute_user_script(user_input):
    """Secure function that fixes the vulnerability."""
    if contains_blacklisted_keywords(user_input):
        raise ValueError("Unauthorized code detected.")
    
    safe_globals = {"__builtins__": {"print": print}}
    exec(user_input, safe_globals)

def contains_blacklisted_keywords(code):
    """Secure function that fixes the vulnerability."""
    blacklist = [
        'import', '__import__', 'eval', 'exec', 'open', 'os', 'sys', 
        'subprocess', 'input', 'compile', 'globals', 'locals', '__', 
        'lambda', 'while', 'for', 'class', 'def', 'del', 'with'
    ]
    return any(bad_word in code for bad_word in blacklist)

def edit_user_profile(user_id, script):
    """Secure function that fixes the vulnerability."""
    execute_user_script(script)

try:
    user_input = "__import__('os').system('rm -rf /')"
    edit_user_profile('user123', user_input)
except ValueError as e:
    print(e)

@misc{vaitp:cve202337909,
  title        = {{XWiki Platform <=15.3-rc-1: Arbitrary script execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-37909},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-37909/}}
}