XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled.
The default macro content parser does not preserve the restricted attribute of the transformation context when processing nested macros. As a result, macros executed inside other macros operate outside restricted mode, even if they should be blocked. The cache and chart macros built into XWiki are vulnerable as they use the described mechanism. An attacker with permissions to add comments can embed nested script macros in them and achieve code execution.
An attacker can execute arbitrary script code in the context of the XWiki server, leading to complete compromise of confidentiality, integrity, and availability of the instance. The vulnerability enables privilege escalation beyond sandbox isolation.
XWiki should be updated to version 13.10.11, 14.4.7, or 14.10, in which the vulnerability has been fixed. As a temporary workaround until updating, the vendor recommends disabling the ability for untrusted users to add comments. Note: users with edit rights can still add comments through the object editor even when comments are disabled.
XWiki Rendering in versions from 4.2-milestone-1 to versions preceding 13.10.11, 14.4.7, and 14.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HXwiki
APPXwiki4.24.3 – 13.10.11 (bez)14.0 – 14.4.7 (bez)14.5 – 14.10 (bez)
Related vulnerabilities
XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch
XWiki Platform — path traversal umożliwia odczyt plików konfiguracyjnych
XWiki Platform: ujawnienie plików konfiguracyjnych przez webjars API (path traversal)
SQL Injection w XWiki Platform via parametr sort w getdeleteddocuments.vm
XWiki Rendering: XSS przez składnię xdom+xml/current w XHTML