Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-16544

Unauthenticated user can retrieve the list of users through getdocuments.vm

    XMLWordPrintable

    Details

    • Tests:
      Unit
    • Development Priority:
      Low
    • Difficulty:
      Hard
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      An unauthenticated user can retrieve the list of users through a public accessible URL
      Note: the dataleak is only true in case of a closed wiki, with specific rights to allow the usage of ForgotUsername/ResetPassword pages.
      Note: a "closed wiki" is when "Prevent unregistered users from viewing pages, regardless of the page rights in the User" is checked in the admin (XWiki.XWikiPreference.authenticate_view = true)

      To reproduce this access one of the following:

      <server>/xwiki/bin/get/XWiki/ForgotUsername?xpage=getdocuments&childrenOf=XWiki&exclude=XWiki.ForgotUsername&queryFilters=unique,hidden&offset=1&limit=100&reqNo=2
      <server>/xwiki/bin/get/XWiki/ResetPassword?xpage=getdocuments&childrenOf=XWiki&exclude=XWiki.ResetPassword&queryFilters=unique,hidden&offset=1&limit=100&reqNo=2
      <server>/xwiki/bin/login/XWikiLogin?xpage=getdocuments&limit=10000

      Note: ForgotUsername/ResetPassword are not accessible anymore, but the issue is still true for XWikiLogin, and needs to be solved in a general way.

      II managed to make them inaccessible by removing the XwikiGuest user from objects of these pages:

      • <server>/xwiki/bin/edit/XWiki/ResetPassword
      • <server>/xwiki/bin/edit/XWiki/ForgotUsername
        But this makes the Reset password / username unusable.

      Note that this issue is not directly related to ResetPassword / ForgotUsername pages: it exists for any page of the wiki available for guest user.

      In addition to getdocuments from the examples above, the following templates could also be used in the same way, and have been fixed accordingly:

      • getdeleteddocuments.vm
      • getgroupmembers.vm
      • getgroups.vm
      • getusers.vm

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              mleduc Manuel Leduc
              Reporter:
              andreic Camelia Andrei
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Date of First Response: