Headline
CVE-2022-23620: It's possible to save pretty much anything anywhere by creating and using an SSX/JSX containing "../" in its reference
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "…/", "./". or “/” in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.
Impact
AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document reference when serializing it on filesystem, so it’s easy to mess up the HTML export process with reference elements containing filesystem syntax like "…/", "./". or “/” in general (the last two not causing any security threat, but can cause conflicts with others serialized files).
Patches
Fixed in 13.6-rc-1
Workarounds
- giving script or subwiki admin right only to trusted people
- disabling HTML/PDF export
References
https://jira.xwiki.org/browse/XWIKI-18819
For more information
If you have any questions or comments about this advisory:
- Open an issue in JIRA
- Email us at XWiki Security Mailing list