org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
Critical severity
GitHub Reviewed
Published
Apr 29, 2025
in
xwiki/xwiki-platform
•
Updated Apr 30, 2025
Package
Affected versions
>= 15.9-rc-1, < 15.10.8
>= 16.0.0-rc-1, < 16.2.0
Patched versions
15.10.8
16.2.0
Description
Published to the GitHub Advisory Database
Apr 29, 2025
Reviewed
Apr 29, 2025
Published by the National Vulnerability Database
Apr 30, 2025
Last updated
Apr 30, 2025
Impact
When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce, as a user without script right, create a class with a
TextAreaproperty, create page with an object of that class and a Velocity macro in its content. Then, as an admin, try editing that page. Normally, there should be a warning but in vulnerable versions of XWiki, there is no warning.Patches
This vulnerability has been patched in XWiki 15.10.8 and 16.2.0.
Workarounds
We're not aware of any workarounds apart from not editing pages that might have been edited by untrusted users as a user with script rights, e.g., by using separate user accounts for admin and non-admin tasks.
References