{"id":"GHSA-p2x4-6ghr-6vmq","summary":"Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui","details":"### Impact\n\nUser without the right to view documents can deduce their existence by repeated Livetable queries.\n\n#### Reproduction steps\n\n1. Restrict \"view\" access to `Sandbox.TestPage3` by setting an explicit view right for admins\n1. As a user who is not an admin, open `\u003cserver\u003e/bin/get/XWiki/LiveTableResults?outputSyntax=plain&classname=&collist=doc.title%2Cdoc.location%2Cdoc.content&doc.title=Sandbo&doc.location=Sandbox.TestPage3&doc.content=dummy&limit=0` where `\u003cserver\u003e` is the URL of your XWiki installation.\n\n#### Expect Result:\n\nNo results are displayed as the user doesn't have view rights on Sandbox.TestPage3.\n\n##### Actual Result:\n\nThe result\n\n```json\n{\n  \"reqNo\": null,\n  \"matchingtags\": {},\n  \"tags\": [],\n  \"totalrows\": 1,\n  \"returnedrows\": 0,\n  \"offset\": 1,\n  \"rows\": [\n    {\n      \"doc_viewable\": false,\n      \"doc_fullName\": \"obfuscated\"\n    }\n  ]\n}\n```\n\nis displayed.\n\nThis reveals that a document `Sandbox.TestPage3` exists (we explicitly searched for this name) which has a title containing `\"Sandbo\"` and a content containing `\"dummy\"`. By starting with a single letter and then iteratively extending the match, the full content of the title/content or XObject properties can be discovered. Several tests can be combined in a single request to use binary search to narrow down the actual match from a list of possible characters/words. If the used alphabet is known and smaller than 128 distinct characters, it is possible to discover one character with 7 requests. Alternatively, frequencies of words and word pairs (2-gram frequencies) can be used to first guess whole words and only resort to guessing individual characters if none of the predicted words match, allowing a much faster recovery of the textual content. As it also depends on the content how easy the attack is and how much recovered content would be a \"successful\" attack, it is hard to quantify how many requests are necessary.\n\n### Patches\n\nThe issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries.\n\n### Workarounds\n\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a) for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be [imported](https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/Imports#HImportingXWikipages), on versions \u003e= 12.10.11, \u003e= 13.9-rc-1, and \u003e= 13.4.4.\n\n### References\n\n- https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a\n- https://jira.xwiki.org/browse/XWIKI-19999\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n","aliases":["CVE-2022-41935"],"modified":"2023-11-01T05:00:06.873757Z","published":"2022-11-21T22:37:47Z","database_specific":{"github_reviewed_at":"2022-11-21T22:37:47Z","nvd_published_at":"2022-11-23T20:15:00Z","cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41935"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19999"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-livetable-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-livetable-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.10.11"},{"fixed":"13.10.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-p2x4-6ghr-6vmq/GHSA-p2x4-6ghr-6vmq.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-livetable-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-livetable-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.4.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-p2x4-6ghr-6vmq/GHSA-p2x4-6ghr-6vmq.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-livetable-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-livetable-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5.0"},{"fixed":"14.6-rc-1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-p2x4-6ghr-6vmq/GHSA-p2x4-6ghr-6vmq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}