Impact Any user who can view Invitation.WebHome can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:

1. Open the invitation application (Invitation.WebHome). 1. Set the subject to {{cache}}{{groovy}}new File("/tmp/exploit.txt").withWriter { out -> out.println("Attacked from invitation!"); }{{/groovy}}{{/cache}} 1. Click "Preview"

Patches The vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6.

Workarounds The vulnerability can be patched manually by applying the patch on Invitation.InvitationCommon and Invitation.InvitationConfig.

References - https://jira.xwiki.org/browse/XWIKI-20421 - https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591

For more information

If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List

Impact

It's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment.

To reproduce: add an attachment to a page (for example, your user profile) add ?xpage=importinline&editor=%22%3E%3Cimg%20src%20onerror=alert(document.domain)%3E to the page view URL as in https://myhost/xwiki/bin/view/XWiki/MyUser?xpage=importinline&editor=%22%3E%3Cimg%20src%20onerror=alert(document.domain)%3E

Patches

This has been patched in XWiki 15.0-rc-1, 14.10.4 and 14.4.8.

Workarounds

The easiest is to edit file <xwiki app>/templates/importinline.vm and apply the modification described on https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01

References

https://jira.xwiki.org/browse/XWIKI-20340 https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK

Attribution

This vulnerability has been reported on Intigriti by René de Sain @renniepak.