CVE-2022-41935: Xwiki platform livetable ui Xwiki-platform-livetable-ui Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p2x4-6ghr-6vmq",
  "modified" : "2022-11-21T22:37:47Z",
  "published" : "2022-11-21T22:37:47Z",
  "aliases" : [ "CVE-2022-41935" ],
  "summary" : "Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui",
  "details" : "### Impact\n\nUser without the right to view documents can deduce their existence by repeated Livetable queries.\n\n#### Reproduction steps\n\n1. Restrict \"view\" access to `Sandbox.TestPage3` by setting an explicit view right for admins\n1. As a user who is not an admin, open `<server>/bin/get/XWiki/LiveTableResults?outputSyntax=plain&classname=&collist=doc.title%2Cdoc.location%2Cdoc.content&doc.title=Sandbo&doc.location=Sandbox.TestPage3&doc.content=dummy&limit=0` where `<server>` is the URL of your XWiki installation.\n\n#### Expect Result:\n\nNo results are displayed as the user doesn't have view rights on Sandbox.TestPage3.\n\n##### Actual Result:\n\nThe result\n\n```json\n{\n  \"reqNo\": null,\n  \"matchingtags\": {},\n  \"tags\": [],\n  \"totalrows\": 1,\n  \"returnedrows\": 0,\n  \"offset\": 1,\n  \"rows\": [\n    {\n      \"doc_viewable\": false,\n      \"doc_fullName\": \"obfuscated\"\n    }\n  ]\n}\n```\n\nis displayed.\n\nThis reveals that a document `Sandbox.TestPage3` exists (we explicitly searched for this name) which has a title containing `\"Sandbo\"` and a content containing `\"dummy\"`. By starting with a single letter and then iteratively extending the match, the full content of the title/content or XObject properties can be discovered. Several tests can be combined in a single request to use binary search to narrow down the actual match from a list of possible characters/words. If the used alphabet is known and smaller than 128 distinct characters, it is possible to discover one character with 7 requests. Alternatively, frequencies of words and word pairs (2-gram frequencies) can be used to first guess whole words and only resort to guessing individual characters if none of the predicted words match, allowing a much faster recovery of the textual content. As it also depends on the content how easy the attack is and how much recovered content would be a \"successful\" attack, it is hard to quantify how many requests are necessary.\n\n### Patches\n\nThe issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries.\n\n### Workarounds\n\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a) for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be [imported](https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/Imports#HImportingXWikipages), on versions >= 12.10.11, >= 13.9-rc-1, and >= 13.4.4.\n\n### References\n\n- https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a\n- https://jira.xwiki.org/browse/XWIKI-19999\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-livetable-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "12.10.11"
      }, {
        "fixed" : "13.10.8"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-livetable-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.0.0"
      }, {
        "fixed" : "14.4.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-livetable-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.5.0"
      }, {
        "fixed" : "14.6-rc-1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-41935"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/xwiki/xwiki-platform"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-19999"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-11-21T22:37:47Z",
    "nvd_published_at" : "2022-11-23T20:15:00Z"
  }
}