PT-2023-20456 · Xwiki · Xwiki Platform

Michael Hamann · Published 2023-03-02 · Updated 2023-03-13 · CVE-2023-26056

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.0-milestone-1 through 14.7 XWiki Platform versions 14.4 through 14.4.4 XWiki Platform versions 13.10 through 13.10.9

Description The issue allows executing a script with the rights of another user, provided the target user does not have programming rights. This can be achieved by using a specific syntax, such as {{context document="xwiki:XWiki.userwithscriptright" transformationContext="document"}}{{velocity}}Hello from Velocity!{{/velocity}}{{/context}}, which should produce an error if the user does not have script rights. However, due to the vulnerability, if the author of the document "xwiki:XWiki.userwithscriptright" has script rights, the script will be executed as if it was written by the target user.

Recommendations For XWiki Platform versions 3.0-milestone-1 through 14.7, update to version 14.8-rc-1 or later. For XWiki Platform versions 14.4 through 14.4.4, update to version 14.4.5 or later. For XWiki Platform versions 13.10 through 13.10.9, update to version 13.10.10 or later. As a temporary workaround, consider restricting the use of the velocity context in documents to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-26056

GHSA-859X-P6JP-RC2W

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26056.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-859x-p6jp-rc2w · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19856 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/bd34ad6710ed72304304a3d5fec38b7cc050ef3b · Patch
• https://github.com/xwiki/xwiki-platform/commit/dd3f4735b41971b3afc3f3aedf6664b4e8be4894 · Patch
• https://github.com/xwiki/xwiki-platform/commit/4b75f212c2dd2dfc5fb5726c7830c6dbc9a425c6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26056 · Security Note
• https://osv.dev/vulnerability/GHSA-859x-p6jp-rc2w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26056 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/59342 · Telegram Post