Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20281

Privilege escalation (PR) from account through TipsPanel

    XMLWordPrintable

Details

    • Unknown
    • N/A

    Description

      Steps to reproduce:

      1. As a user without script or programming rights, edit your user profile with the object editor (enable the advanced user type first if necessary).
      2. Add an object of type UIExtensionClass
      3. Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel
      4. Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter)
      5. Set "Extension Parameters" to
        tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
      6. Set "Extension Scope" to "Current User".
      7. Click "Save & View"
      8. Open the "Help.TipsPanel" document at <xwiki-host>/xwiki/bin/view/Help/TipsPanel where <xwiki-host> is the URL of your XWiki installation and press refresh repeatedly.

      Expected result:

      Either, the provided tip is never displayed, or the entered tip is displayed as-is or an error that the user cannot execute Groovy macros is displayed.

      Actual result:

      At some point, "Hello from groovy!" is displayed. As the displayed tip is selected randomly, this may need many refreshes. This shows that the Groovy macro has been executed and thus demonstrates a privilege escalation from a simple user account to programming rights.

      Attachments

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: