Steps to reproduce:
- Login as a user with just edit rights on the user profile and enable advanced mode and enable displaying hidden pages
- Edit the user profile with the wiki editor and insert the following content
- Edit the user profile with the object editor and insert an object of type "XWiki Sheet include". Select "IconThemeSheet" as sheet and click "Save & View".
The provided input is displayed as-is as the color theme's code.
is displayed, showing that we've just executed code with programming and global admin rights.
This demonstrates a privilege escalation from a user with just edit rights on the user profile to global admin and programming rights. The escalation is possible through the combination of two issues:
- The IconThemeSheet includes $doc.content without escaping, allowing to execute macros in the context of the sheet that has programming rights.
- The async macro allows circumventing the protection against nested script macros.