| Impact
The "Edit Warning" mechanism, designed to prevent Administrators from inadvertently executing malicious scripts created by lower-privileged users, can be completely bypassed via the HTTP GET parameter force=1. This transforms a standard Privilege Escalation vulnerability into a One-Click Remote Code Execution (RCE) attack. An attacker can craft a malicious link (e.g., pointing to a trapped page) and send it to an Administrator. Upon clicking the link, the Administrator is forced directly into the editing context, triggering the execution of the malicious payload (Groovy script) immediately, without any warning or confirmation dialog. Technical Analysis
Vulnerable Component: Wiki Editor / Lock Mechanism Vulnerable Parameter: force=1 Root Cause: The application logic accepts the force parameter in the URL to suppress the security warning about privilege elevation. This parameter is processed before rendering the page, causing the editor to load (and execute scripts) instantly with the current user's (Admin) privileges. Proof of Concept
Step 1: Preparation (Attacker - Low Privileges) 1. Log in as a standard user. 2. Create a page/application (e.g., Stored_RCE). Inject a Groovy Reverse Shell payload (report https://jira.xwiki.org/browse/XWIKI-23762) into the content.  3. Save the page. Step 2: The Trap (Social Engineering) 4. The attacker crafts a link to the malicious page, appending ?force=1 to the Edit URL: http://localhost:8090/bin/edit/Stored_RCE?force=1 5. The attacker sends this link to an Administrator (e.g., via email, chat, or a comment on another page: "Can you please check this page? It creates an error in the editor"). Step 3: Execution (Victim - Administrator) 6. The Administrator clicks the link.
 7. The "Restricted Edit" warning page is skipped. 8. The Editor loads immediately. The XWiki rendering engine processes the groovy macro using the Administrator's Programming Rights. 
8. The Reverse Shell is executed, and the attacker gains root access. 
The attached screenshot confirms that accessing the URL with ?force=1 loads the editor directly (bypassing the warning) while simultaneously executing the payload. Patches
The force parameter should not be accepted via GET request for privilege escalation warnings, or it should require a valid CSRF token that cannot be predicted by the attacker. Alternatively, executing scripts in Edit mode should be strictly disabled regardless of the "force" parameter. Attribution
Reported by: Łukasz Rybak GitHub: https://github.com/lukasz-rybak |
