xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

An attacker who can edit a page creates a page whose title contains XWiki syntax such as `{{async}}{{groovy}}...{{/groovy}}{{/async}}`. When the `excerpt-include` macro includes that page, the unescaped title is injected into the output and executed as XWiki syntax. Similarly, the excerpt content is rendered and executed with the macro's rights, enabling remote code execution [CWE-95] [ref_id=1].

The vulnerability is in `ExcerptInclude.xml` at line 277, where the title of the included page is not escaped before being output. Additionally, the excerpt macro's content is rendered to XWiki syntax and executed with the macro's rights, allowing injection of arbitrary XWiki syntax.

The advisory does not include a published patch. The fix would need to escape the page title at `ExcerptInclude.xml#L277` before output and ensure that excerpt content is not executed with the macro's rights. Until a fix is applied, users should restrict edit permissions to trusted users.

1. As a user without script or programming right, create a page named `Exploit`. 2. In the edit screen, change the title to `{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}`. 3. Set the content to: ``` {{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}}

{{excerpt}} {{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}} {{/excerpt}} ``` 4. Save and view the page. 5. If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded.