XWiki 4.5.1 < 15.10.13, 16.0.0-rc-1 < 16.4.4, 16.5.0-rc-1 < 16.8.0 Incorrect Authorization Vulnerability (GHSA-987p-r3jc-8c8v)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:xwiki:xwiki";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.124870");
  script_version("2025-11-19T05:40:23+0000");
  script_tag(name:"last_modification", value:"2025-11-19 05:40:23 +0000 (Wed, 19 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-07-18 05:10:52 +0000 (Fri, 18 Jul 2025)");
  script_tag(name:"cvss_base", value:"4.7");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:M/C:N/I:P/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-05-13 15:06:38 +0000 (Tue, 13 May 2025)");

  script_cve_id("CVE-2025-32971");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("XWiki 4.5.1 < 15.10.13, 16.0.0-rc-1 < 16.4.4, 16.5.0-rc-1 < 16.8.0 Incorrect Authorization Vulnerability (GHSA-987p-r3jc-8c8v)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_xwiki_http_detect.nasl");
  script_mandatory_keys("xwiki/detected");

  script_tag(name:"summary", value:"Xwiki is prone to an incorrect authorization vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The Solr script service that is accessible in XWiki's scripting
  API normally requires programming right to be called. Due to using the wrong API for checking
  rights, it doesn't take the fact into account that programming rights might have been dropped by
  calling $xcontext.dropPermissions(). If some code relies on this for the safety of executing
  Velocity code with the wrong author context, this could allow a user with script right to either
  cause a high load by indexing documents or to temporarily remove documents from the search
  index.");

  script_tag(name:"affected", value:"XWiki version 4.5.1 prior to 15.10.13, 16.0.0-rc-1 prior
  to 16.4.4 and 16.5.0-rc-1 prior to 16.8.0.");

  script_tag(name:"solution", value:"Update to version 15.10.13, 16.4.4, 16.8.0 or later.");

  script_xref(name:"URL", value:"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-987p-r3jc-8c8v");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if ( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_in_range_exclusive( version:version, test_version_lo:"4.5.1", test_version_up:"15.10.13" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"15.10.13", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.0.0-rc-1", test_version_up:"16.4.4" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.4.4", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.5.0-rc-1", test_version_up:"16.8.0" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.8.0", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );