GHSA-vwr6-qp4q-2wj7
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
Quick fix
GHSA-vwr6-qp4q-2wj7 — org.xwiki.platform:xwiki-platform-icon-ui: upgrade to the fixed version with the command below.
# pom.xml: bump <version>13.10.10</version> for org.xwiki.platform:xwiki-platform-icon-uiDetails
### Impact
One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:
``` }}} {{async async="true"}} {{groovy}} println("Hello from Groovy!") {{/groovy}} {{/async}} {{{ ```
Can be done by creating a new page or even through the user profile for users not having edit right.
### Patches
This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.
### Workarounds
An easy workaround is to actually fix the bug in the page `IconThemesCode.IconThemeSheet` by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45
### References
https://jira.xwiki.org/browse/XWIKI-19731
### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](http://jira.xwiki.org) * Email us at [Security ML](mailto:security@xwiki.org)
Are you affected?
Enter the version of the package you're using.
Affected packages
6.2-milestone-1Fixed in: 13.10.10# pom.xml: bump <version>13.10.10</version> for org.xwiki.platform:xwiki-platform-icon-ui14.0Fixed in: 14.4.6# pom.xml: bump <version>14.4.6</version> for org.xwiki.platform:xwiki-platform-icon-ui14.5Fixed in: 14.9# pom.xml: bump <version>14.9</version> for org.xwiki.platform:xwiki-platform-icon-uiReferences
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2023-26472[ADVISORY]
- https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45[WEB]
- https://github.com/xwiki/xwiki-platform[PACKAGE]
- https://jira.xwiki.org/browse/XWIKI-19731[WEB]