Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20306

Privilege escalation (PR) from account through IncludedDocuments panel

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce:

      1. As an admin, add the Panels.IncludedDocuments panel on one column
      2. As a user without script or programming right open your user account (or any other document you can edit with the wiki editor.
      3. Set the content to
        {{display reference="{{cache~}~}{{groovy~}~}println(~"Hello from Groovy~" + ~" in included document!~"){{/groovy~}~}{{/cache~}~}"/}}

        .

      1. Click "Save and continue"

      Expected result:

      The panel displays

      One included page: 
      {{cache}}{{groovy}}println("Hello from Groovy" + " in included document!"){{/groovy}}{{/cache}}

      .

      Actual result:

      The panel displays the text

      One included page:
          XWiki.Hello from Groovy in included document!

      This demonstrates a privilege escalation from simple user account to programming rights.

      Attachments

        Issue Links

          Activity

            People

              mleduc Manuel Leduc
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: