Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20566

Privilege escalation (PR)/RCE from account through class sheet

    XMLWordPrintable

Details

    • Unknown
    • N/A

    Description

      Steps to Reproduce:

      1. Edit your user profile with the object editor and add an object of type DocumentSheetBinding with value Default Class Sheet
      2. Edit your user profile with the wiki editor and add the syntax
        {{async}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
      3. Click "Save & View"

      Expected result:

      An error is displayed as the user doesn't have the right to execute the Groovy macro.

      Actual result:

      The text "Hello from groovy!" is displayed at the top of the document.

      It cannot be reproduced in 15.* thanks to XWIKI-5027, but we need to add an explicit indication that the included content should be executed with the right of its author in 14.10.x.

      Attachments

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              tmortagne Thomas Mortagne
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: