CVE-2023-35166: Privilege escalation (PR) from account through TipsPanel

Steps to reproduce:

1. As a user without script or programming rights, edit your user profile with the object editor (enable the advanced user type first if necessary).

2. Add an object of type UIExtensionClass

3. Set “Extension Point ID” to org.xwiki.platform.help.tipsPanel

4. Set “Extension ID” to org.xwiki.platform.user.test (needs to be unique but otherwise doesn’t matter)

5. Set “Extension Parameters” to

   tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + “from groovy!”){{/groovy}}{{/async}}

6. Set “Extension Scope” to "Current User".

7. Click “Save & View”

8. Open the “Help.TipsPanel” document at <xwiki-host>/xwiki/bin/view/Help/TipsPanel where <xwiki-host> is the URL of your XWiki installation and press refresh repeatedly.

Expected result:

Either, the provided tip is never displayed, or the entered tip is displayed as-is or an error that the user cannot execute Groovy macros is displayed.

Actual result:

At some point, “Hello from groovy!” is displayed. As the displayed tip is selected randomly, this may need many refreshes. This shows that the Groovy macro has been executed and thus demonstrates a privilege escalation from a simple user account to programming rights.