XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
Critical severity
GitHub Reviewed
Published
Oct 16, 2023
in
xwikisas/identity-oauth
•
Updated Nov 7, 2023
Package
Affected versions
>= 1.0, < 1.6
Patched versions
1.6
Description
Published by the National Vulnerability Database
Oct 16, 2023
Published to the GitHub Advisory Database
Oct 17, 2023
Reviewed
Oct 17, 2023
Last updated
Nov 7, 2023
Impact
When login via the OAuth method, the identityOAuth parameters, sent in a GET request is vulnerable to XSS and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation.
The vulnerability is in this part of the code.
Patches
The issue has been fixed in Identity OAuth version 1.6 by xwikisas/identity-oauth@d805d31 . The fix is in the content of the IdentityOAuth/LoginUIExtension file
Workarounds
There are no known workarounds besides upgrading.
References
Are there any links users can visit to find out more?
References