CVE-2022-41928: Xwiki platform attachment ui Improper Neutralization Of Directives Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9hqh-fmhg-vq2j",
  "modified" : "2022-11-21T22:34:57Z",
  "published" : "2022-11-21T22:34:57Z",
  "aliases" : [ "CVE-2022-41928" ],
  "summary" : "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml",
  "details" : "### Impact\nAny user with the right to edit his personal page can follow one of the scenario below:\n\n**Scenario 1**:\n- Log in as a simple user with just edit rights on the user profile\n- Go to the user's profile\n- Upload an attachment in the attachment tab at the bottom of the page (any image is fine)\n- Click on \"rename\" in the attachment list and enter `{{async async=\"true\" cached=\"false\" context=\"doc.reference\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/async}}.png` as new attachment name and submit the rename\n- Go back to the user profile\n- Click on the edit icon on the user avatar\n- `Hello from groovy!` is displayed as the title of the attachment\n\n**Scenario 2**:\n- Log in as a simple user with just edit rights on a page\n- Create a Page `MyPage.WebHome`\n- Create an XClass field of type String named `avatar`\n- Add an XObject of type `MyPage.WebHome` on the page\n- Insert an `attachmentSelector` macro in the document with the following values:\n  - **classname**: `MyPage.WebHome`\n  - **property**: `avatar`\n  - **savemode**: `direct`\n  - **displayImage**: `true`\n  - **width**: `]] {{async async=\"true\" cached=\"false\" context=\"doc.reference\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/async}}`. You'll find below a snippet of an `attachmentSelector` macro declaration.\n- Display the page\n- Use the attachment picker to select an image\n- `Hello from groovy` is displayed aside the image\n\nExample of an `attachmentSelector` macro declaration:\n```\n`{{attachmentSelector classname=\"MyPage.WebHome\" property=\"avatar\" savemode=\"direct\" displayImage=\"true\" width=\"]] {{async async=~\"true~\" cached=~\"false~\" context=~\"doc.reference~\"~}~}{{groovy~}~}println(~\"Hello from groovy!~\"){{/groovy~}~}{{/async~}~}\"/}}`\n```\n\n**Note**: The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties.\n\n### Patches\nThe issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below:\n\n- 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23\n- 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23\n- 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23\n\n### Workarounds\nNo known workaround.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-19800\n\n### For more information\nIf you have any questions or comments about this advisory:\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-attachment-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0-milestone-1"
      }, {
        "fixed" : "13.10.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-attachment-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.0.0"
      }, {
        "fixed" : "14.4.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-41928"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/xwiki/xwiki-platform"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-19800"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-95" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-11-21T22:34:57Z",
    "nvd_published_at" : "2022-11-23T19:15:00Z"
  }
}