PT-2023-4805 · Xwiki+1 · Xwiki+1
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
XWiki versions prior to 13.10.11
XWiki versions prior to 14.4.7
XWiki versions prior to 14.10
Description
The issue allows any user with view rights on commonly accessible documents, including the legacy notification activity macro, to execute arbitrary Groovy, Python, or Velocity code in XWiki, leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable, including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki.
Recommendations
For versions prior to 13.10.11, update to version 13.10.11 or later.
For versions prior to 14.4.7, update to version 14.4.7 or later.
For versions prior to 14.10, update to version 14.10 or later.
As a temporary workaround, consider replacing the code of the legacy notification activity macro with the patched version or deleting the document XWiki.Notifications.Code.Legacy.ActivityMacro if the macro isn't used.
Exploit
Correção
Eval Injection
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ckeditor
Xwiki