CVE-2023-40177: Xwiki platform appwithinminutes ui XWiki Platform Privilege Escalation (PR) Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5mf8-v43w-mfxp",
  "modified" : "2023-08-21T20:10:55Z",
  "published" : "2023-08-21T20:10:55Z",
  "aliases" : [ "CVE-2023-40177" ],
  "summary" : "XWiki Platform privilege escalation (PR) from account through AWM content fields",
  "details" : "### Impact\n\nAny registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation.\n\nThe problem is present [since version 4.3M2](https://jira.xwiki.org/browse/XWIKI-7369) when AppWithinMinutes Application added support for the Content field, allowing any wiki page (including the user profile page) to use its content as an AWM Content field, which has a custom displayer that executes the content with the rights of the ``AppWithinMinutes.Content`` author, rather than the rights of the content author.\n\n### Patches\n\nThe issue has been fixed in XWiki 14.10.5 and 15.1RC1 by https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262 . The fix is in the content of the [AppWithinMinutes.Content](https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262#diff-850f6875c40cf7932f40a985e99679a041891c6ee75d10239c06921c0019cf78R82) page that defines the custom displayer. By using the ``display`` script service to render the content we make sure that the proper author is used for access rights checks.\n\n### Workarounds\n\nIf you want to fix this problem on older versions of XWiki that have not been patched then you need to modify the content of ``AppWithinMinutes.Content`` page to use the ``display`` script service to render the content, like this:\n\n```\n- {{html}}$tdoc.getRenderedContent($tdoc.content, $tdoc.syntax.toIdString()).replace('{{', '{{'){{/html}}\n+ {{html}}$services.display.content($tdoc, {\n+   'displayerHint': 'default'\n+ }).replace('{{/html}}', '{{/html}}'){{/html}}\n```\n\n### References\n\n* JIRA issue https://jira.xwiki.org/browse/XWIKI-19906\n* Fix https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been found and reported by @michitux .",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-appwithinminutes-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.3-milestone-2"
      }, {
        "fixed" : "14.10.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5mf8-v43w-mfxp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-40177"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/xwiki/xwiki-platform"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-7369"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-95" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-08-21T20:10:55Z",
    "nvd_published_at" : "2023-08-23T21:15:08Z"
  }
}