GHSA-vpx4-7rfp-h545: Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-26473

Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm

Moderate severity GitHub Reviewed Published Mar 1, 2023 in xwiki/xwiki-platform • Updated Mar 3, 2023

Package

maven org.xwiki.platform:xwiki-platform-web (Maven)

Affected versions

>= 1.3-rc-1, < 13.10.11

>= 14.0, < 14.4.7

>= 14.5, < 14.10

Patched versions

13.10.11

14.4.7

14.10

Impact

Any user with edit right can execute arbitrary database select and access data stored in the database.

To reproduce:

• In admin, rights, remove scripting rights for {{XWikiAllGroup}}.
• Create a new user without any special privileges.
• Create a page “Private.WebHome” with {{TOKEN_42}} as content. Go to “page administration” and explicitly set all rights for “Admin” to remove them for all other users.
• Logout and login as the unprivileged user. Ensure that the previously created page cannot be viewed.
• Create a new page “ExploitClass.WebHome” and then open it in the class editor (first, make the user an advanced user).
• Add a field named {{ContentList}} of type {{Database List}}
• Enter in field “Hibernate Query” the following content: {noformat}select doc.content, doc.fullName from XWikiDocument as doc where doc.fullName = 'Private.WebHome’{noformat}
• Save the class.
• Open [http://localhost:8080/xwiki/bin/view/ExploitClass/?xpage=suggest&classname=ExploitClass.WebHome&fieldname=ContentList&firCol=doc.fullName&secCol=-]

Patches

The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Workarounds

There is no workaround for this vulnerability other than upgrading.

References

https://jira.xwiki.org/browse/XWIKI-19523

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki.org
• Email us at Security Mailing List

References

• GHSA-vpx4-7rfp-h545
• https://nvd.nist.gov/vuln/detail/CVE-2023-26473
• https://jira.xwiki.org/browse/XWIKI-19523

Published by the National Vulnerability Database

Mar 2, 2023

Published to the GitHub Advisory Database

Mar 3, 2023