Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter

Impact

The PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter.

However, the application does not validate the supplied URL. An attacker can supply an internal IP address  or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram.

PoC

1. Use an OAST service (like Burp Collaborator) to capture the interaction.
2.  Create a wiki page with the following content:
 
{{plantuml server="http://oqiusawt5ny84yw017u6qgnay14ssmgb.oastify.com"
@startuml
A -> B: SSRF Test
@enduml
{{/plantuml}}

2. Save and View the page.

3. The XWiki server initiates an HTTP connection to the specified target.

Attribution

Reported by: Łukasz Rybak GitHub: https://github.com/lukasz-rybak