CVE-2023-35166: Privilege escalation (PR) from account through TipsPanel
Impact
It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension.
To reproduce: Add an object of type UIExtensionClass Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter) Set "Extension Parameters" to tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}} Set "Extension Scope" to "Current User". Click "Save & View" Open the "Help.TipsPanel" document at <xwiki-host>/xwiki/bin/view/Help/TipsPanel where <xwiki-host> is the URL of your XWiki installation and press refresh repeatedly.
The groovy macro is executed, after the fix you get an error instead.
Patches
This has been patched in XWiki 15.1-rc-1 and 14.10.5.
Workarounds
There are no known workarounds for it.
References
https://jira.xwiki.org/browse/XWIKI-20281 https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-help-uito a version that resolves this vulnerability.Fixed in 15.1-rc-1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-help-uito a version that resolves this vulnerability.Fixed in 14.10.5 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 15.1-rc-1 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.10.5
Event History
Frequently Asked Questions
What is CVE-2023-35166?
CVE-2023-35166 is a vulnerability in XWiki Platform that allows an attacker with the right permissions to execute any wiki content through a tip UI extension.
How severe is CVE-2023-35166?
CVE-2023-35166 has a severity rating of 8.8, which is considered critical.
Which versions of XWiki are affected by CVE-2023-35166?
Versions of XWiki from 8.1 to 14.10.5 are affected by CVE-2023-35166.
How can I fix CVE-2023-35166?
To fix CVE-2023-35166, you should update XWiki to version 15.1-rc-1 or 14.10.5.
Where can I find more information about CVE-2023-35166?
You can find more information about CVE-2023-35166 in the references provided: [GitHub Commit](https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178), [GitHub Security Advisories](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h), and [XWiki JIRA](https://jira.xwiki.org/browse/XWIKI-20281).