Incorrect Authorization Affecting org.xwiki.rendering:xwiki-rendering-transformation-macro package, versions [4.2-milestone-1,13.10.11)[14.0,14.4.7)[14.5,14.10)

Affected versions of this package are vulnerable to Incorrect Authorization via improper handling of the restricted attribute of the transformation context during the processing of nested macros. An attacker can execute arbitrary code with elevated privileges by crafting malicious macro content that bypasses intended restrictions. This is exploitable with any macro that uses the macro content parser with the transform parameter set to true, such as the cache and chart macros that are bundled in XWiki.

Note: This is only exploitable if an attacker can submit specially crafted macro syntax, e.g., through comments or using the object editor.

This vulnerability can be partially mitigated by disabling comments for untrusted users.

Note: Users with edit rights will still be able to add comments via the object editor even if comments have been disabled.

{{cache}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/cache}}

• GitHub Commit
• GitHub Commit
• XWiki Jira
• XWiki Jira