| Started as a follow-up of XWIKI-24212 When an SSX (StyleSheetExtension) XObject has contentType=LESS and parse=1, the LESS compiler processes it through a different code path than plain CSS. In this LESS path, the Velocity evaluation runs as superadmin, regardless of the page content author, metadata author, or any other author field. This happens because LESSObjectPropertyResourceReference does not implement the WikiLESSResourceReference interface that the compiler uses to determine the correct author context. When the interface check fails, CachedLESSCompiler falls back to InternalTemplateManager.SUPERADMIN_REFERENCE. Any user with edit right on any page (including pages they created themselves) can achieve superadmin level velocity execution by adding an SSX XObject with contentType=LESS. —
This one is actually worse than XWIKI-24212 as we don't need an admin page at all (even if it's really easy to find an admin page). Setup
We only need a standard user.
- Create a page (ex: LESSProbe)
- Add a StyleSheetExtension on that page:
- name: LESSProbe
- code:
#set($g = $xwiki.parseGroovyFromString('class T { String go() { return System.getProperty("user.name") } }'))
#set($user = $g.go())
body { font-family: ${user}; color: red; }
- User This Extension: on this page or on demand
- Parse Content: YES
- Caching Policy: no caching
- Content Type: LESS
- As guest, just trigger it:
Returns
body{font-family:xwiki;color:red}
This example will just return the username of the account running xwiki. But with programming rights we can do anything. This issue also leads to broader RCE once planted, as a guest can trigger it. fix?
LESSObjectPropertyResourceReference.java should implement WikiLESSResourceReference and return the document reference of the page containing the SSX XObject. This causes CachedLESSCompiler to use the document author for velocity evaluation instead of falling back to superadmin. |
