Skip to content

It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro

Low severity GitHub Reviewed Published Mar 11, 2021 in xwiki/xwiki-platform • Updated Feb 1, 2023

Package

maven org.xwiki.platform:xwiki-platform-rendering-wikimacro-store (Maven)

Affected versions

>= 11.4, < 11.10.11
>= 12.0, < 12.6.3
>= 12.7, <= 12.7.1

Patched versions

11.10.11
12.6.3
12.8

Description

Impact

The {{wikimacrocontent}} executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).

Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.

Patches

It has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.

Workarounds

There is no easy workaround other than disabling the affected macros.
Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

References

https://jira.xwiki.org/browse/XWIKI-17759

For more information

If you have any questions or comments about this advisory:

References

@tmortagne tmortagne published to xwiki/xwiki-platform Mar 11, 2021
Published by the National Vulnerability Database Mar 12, 2021
Reviewed Mar 23, 2021
Published to the GitHub Advisory Database Mar 23, 2021
Last updated Feb 1, 2023

Severity

Low

EPSS score

0.054%
(24th percentile)

Weaknesses

CVE ID

CVE-2021-21379

GHSA ID

GHSA-v662-xpcc-9xf6

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.