ghsa-vpx4-7rfp-h545
Vulnerability from github
Impact
Any user with edit right can execute arbitrary database select and access data stored in the database.
To reproduce: * In admin, rights, remove scripting rights for {{XWikiAllGroup}}. * Create a new user without any special privileges. * Create a page "Private.WebHome" with {{TOKEN_42}} as content. Go to "page administration" and explicitly set all rights for "Admin" to remove them for all other users. * Logout and login as the unprivileged user. Ensure that the previously created page cannot be viewed. * Create a new page "ExploitClass.WebHome" and then open it in the class editor (first, make the user an advanced user). * Add a field named {{ContentList}} of type {{Database List}} * Enter in field "Hibernate Query" the following content: {noformat}select doc.content, doc.fullName from XWikiDocument as doc where doc.fullName = 'Private.WebHome'{noformat} * Save the class. * Open [http://localhost:8080/xwiki/bin/view/ExploitClass/?xpage=suggest&classname=ExploitClass.WebHome&fieldname=ContentList&firCol=doc.fullName&secCol=-]
Patches
The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.
Workarounds
There is no workaround for this vulnerability other than upgrading.
References
https://jira.xwiki.org/browse/XWIKI-19523
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-web"
},
"ranges": [
{
"events": [
{
"introduced": "1.3-rc-1"
},
{
"fixed": "13.10.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-web"
},
"ranges": [
{
"events": [
{
"introduced": "14.0"
},
{
"fixed": "14.4.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-web"
},
"ranges": [
{
"events": [
{
"introduced": "14.5"
},
{
"fixed": "14.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26473"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-03T22:46:43Z",
"nvd_published_at": "2023-03-02T19:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nAny user with edit right can execute arbitrary database select and access data stored in the database.\n\nTo reproduce:\n * In admin, rights, remove scripting rights for {{XWikiAllGroup}}.\n * Create a new user without any special privileges.\n * Create a page \"Private.WebHome\" with {{TOKEN_42}} as content. Go to \"page administration\" and explicitly set all rights for \"Admin\" to remove them for all other users.\n * Logout and login as the unprivileged user. Ensure that the previously created page cannot be viewed.\n * Create a new page \"ExploitClass.WebHome\" and then open it in the class editor (first, make the user an advanced user).\n * Add a field named {{ContentList}} of type {{Database List}}\n * Enter in field \"Hibernate Query\" the following content: {noformat}select doc.content, doc.fullName from XWikiDocument as doc where doc.fullName = \u0027Private.WebHome\u0027{noformat}\n * Save the class.\n * Open [http://localhost:8080/xwiki/bin/view/ExploitClass/?xpage=suggest\u0026classname=ExploitClass.WebHome\u0026fieldname=ContentList\u0026firCol=doc.fullName\u0026secCol=-]\n\n### Patches\n\nThe problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.\n\n### Workarounds\n\nThere is no workaround for this vulnerability other than upgrading.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-19523\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
"id": "GHSA-vpx4-7rfp-h545",
"modified": "2023-03-03T22:46:43Z",
"published": "2023-03-03T22:46:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26473"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-19523"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.