PT-2022-23189 · Xwiki · Xwiki Platform Wiki Ui Main Wiki

Michael Hamann · Published 2022-09-08 · Updated 2023-06-27 · CVE-2022-36099

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5 XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3

Description It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the XWikiServerClassSheet if the user has view access to this sheet and another page that has been saved with programming rights. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. The issue can be triggered by opening the URL "/xwiki/bin/view/Main/?sheet=XWiki.XWikiServerClassSheet&form token=

&action=delete&domain=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D" on current versions, or "/xwiki/bin/view/Main/?sheet=WikiManager.XWikiServerClassSheet&form token=&action=delete&domain=foo%22%2F%7D%7D%7B%7B%2Ferror%7D%7D%7B%7B%2Fhtml%7D%7D%7B%7Bfootnote%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Ffootnote%7D%7D" on version 5.3 Milestone 2.

Recommendations For XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5, edit the affected document XWiki.XWikiServerClassSheet or WikiManager.XWikiServerClassSheet and manually perform the changes from the patch fixing the issue. For XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3, edit the affected document XWiki.XWikiServerClassSheet or WikiManager.XWikiServerClassSheet and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document XWiki.XWikiServerClassSheet from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.

Exploit

Fix

Code Injection

Improper Encoding or Escaping of Output

Eval Injection

Weakness Enumeration

CWE-94

CWE-116

CWE-95

Related Identifiers

CVE-2022-36099

GHSA-XR6M-2P4M-JVQF

Affected Products

Xwiki Platform Wiki Ui Main Wiki

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36099.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqf · Exploit
• https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc · Patch
• https://osv.dev/vulnerability/CVE-2022-36099 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36099 · Security Note
• https://osv.dev/vulnerability/GHSA-xr6m-2p4m-jvqf · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/49478 · Telegram Post
• https://t.me/cvenotify/35904 · Telegram Post