Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20360

RCE in Annotations

    XMLWordPrintable

Details

    • Unknown
    • N/A

    Description

      SUBMISSION REFERENCES

      RESEARCHER INFORMATION

      • Submitter: renniepak

      SUBMISSION INFORMATION

      • Created at: Tue, 15 Nov 2022 08:09:01 GMT
      • Submission status: Archived

      REPORT CONTENT

      I've found a way a regular user can get Remote Code Execution through adding an annotation containing Python code.

        1. Reproduction

      1. Login as a regular user
      2. Navigate to any content page. For example: https://intigriti.xwiki.com/xwiki/bin/view/Help/Videos/
      3. Select a line of text and hit Ctrl+M to add an annotation:
      4. Click the `Source` button and add the following code:

      ```python
      python
      import subprocess
      print(subprocess.check_output("id", shell=True))
      /python
      ```

      {959652}

      5. Click `Add Annotation`
      6. Append `?viewer=annotations` to the url so that it becomes https://intigriti.xwiki.com/xwiki/bin/view/Help/Videos/?viewer=annotations

        1. Result

      Our annotation will execute the suplied code.

      {671035}
      • Impact: Any low privileged user can abuse this to run arbitrary code on the server. Doing so they can completely compromise the application and server and it's data.
      • Personal data involved: No
      • Endpoint: https://intigriti.xwiki.com/xwiki/bin/view/Help/Videos/
      • Type: Remote Code Execution
      • Attachments: Screenshot 2022-11-15 090521.png, Screenshot 2022-11-15 090822.png

      Attachments

        1. 149300_a3.jpg
          48 kB
          Intigriti Integration
        2. 671035_Screenshot 2022-11-15 090822.png
          29 kB
          Intigriti Integration
        3. 959652_Screenshot 2022-11-15 090521.png
          66 kB
          Intigriti Integration

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              intigriti Intigriti Integration
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: