CVE-2020-15252: 
Java vulnerability analysis and mitigation

In XWiki versions before 12.5 and 11.10.6, a critical security vulnerability was identified where users with SCRIPT right (EDIT right before XWiki 7.4) could gain unauthorized access to the application server Servlet context. This vulnerability, tracked as CVE-2020-15252, was discovered by GitHub Security Lab team member @pwntester (Alvaro Munoz) and was disclosed in October 2020 (GitHub Advisory).

The vulnerability stems from improper access control to the Servlet Context through $xcontext.request and $context.request binding. Through deep inspection of exposed objects' object graph, attackers could access the Servlet Context via $request.getServletContext(). This access allowed attackers to obtain an Instance Manager, which could be used to instantiate arbitrary Java objects and invoke methods, effectively bypassing the sandbox. For example, attackers could use the Tomcat InstanceManager to create a ScriptEngineManager and execute arbitrary code (GitHub Advisory).

The vulnerability could lead to Remote Code Execution (RCE), allowing attackers to execute arbitrary Java code or run system commands with the same privileges as the account running XWiki. This posed a significant security risk as it could result in complete system compromise (GitHub Advisory).

The vulnerability required an attacker to have SCRIPT right (or EDIT right in versions before XWiki 7.4) to exploit. Once these permissions were obtained, the attacker could access the Servlet Context and use it to instantiate arbitrary Java objects, leading to code execution (GitHub Advisory).

The vulnerability was patched in XWiki versions 12.5 and 11.10.6. Before applying the patch, the only available workaround was to give SCRIPT right only to trusted users. The fix involved limiting the objects that are available through the Templating API, particularly restricting access to Servlet Context attributes (GitHub Advisory).