GHSA-h7cw-44vp-jq7h

Suggest an improvement
Source
https://github.com/advisories/GHSA-h7cw-44vp-jq7h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-h7cw-44vp-jq7h/GHSA-h7cw-44vp-jq7h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h7cw-44vp-jq7h
Aliases
Published
2023-06-20T19:55:36Z
Modified
2023-11-08T04:12:51Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel
Details

Impact

It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension.

To reproduce:

  • Add an object of type UIExtensionClass
  • Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel
  • Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter)
  • Set "Extension Parameters" to 
    tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
  • Set "Extension Scope" to "Current User".
  • Click "Save & View"
  • Open the "Help.TipsPanel" document at /xwiki/bin/view/Help/TipsPanel where is the URL of your XWiki installation and press refresh repeatedly.

The groovy macro is executed, after the fix you get an error instead.

Patches

This has been patched in XWiki 15.1-rc-1 and 14.10.5.

Workarounds

There are no known workarounds for it.

References

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-20T19:55:36Z",
    "nvd_published_at":  "2023-06-20T20:15:09Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-help-ui

Package

Name
org.xwiki.platform:xwiki-platform-help-ui
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-help-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.1-milestone-1
Fixed
14.10.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-h7cw-44vp-jq7h/GHSA-h7cw-44vp-jq7h.json"

Maven / org.xwiki.platform:xwiki-platform-help-ui

Package

Name
org.xwiki.platform:xwiki-platform-help-ui
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-help-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15.0-rc-1
Fixed
15.1-rc-1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-h7cw-44vp-jq7h/GHSA-h7cw-44vp-jq7h.json"