PT-2023-29430 · Xwiki · Xwiki Platform+2

Michael Hamann · Published 2023-10-25 · Updated 2023-11-02 · CVE-2023-45134

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.1-milestone-1 through 13.4-rc-1 org.xwiki.platform:xwiki-platform-web-templates versions prior to 14.10.2 and 15.5-rc-1 org.xwiki.platform:xwiki-web-standard versions 2.4-milestone-2 through 3.1-milestone-1

Description The issue allows an attacker to create a template provider on any document that is part of the wiki, which contains malicious code. This code is executed when the template provider is selected during document creation, which can be triggered by sending the user to a URL. The attacker only needs to have an account, as the own user profile is editable by default. This enables the attacker to execute arbitrary actions with the rights of the user opening the malicious link, potentially allowing remote code execution and full read and write access to the whole XWiki installation.

Recommendations For versions 3.1-milestone-1 through 13.4-rc-1 of XWiki Platform, update to version 13.4-rc-1 or later. For versions prior to 14.10.2 and 15.5-rc-1 of org.xwiki.platform:xwiki-platform-web-templates, update to version 14.10.2 or 15.5-rc-1 or later. For versions 2.4-milestone-2 through 3.1-milestone-1 of org.xwiki.platform:xwiki-web-standard, update to version 3.1-milestone-1 or later. As a temporary workaround, consider manually applying the changes from the fix to the vulnerable template file createinline.vm.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-45134

GHSA-GR82-8FJ2-GGC3

Affected Products

Xwiki Platform

Xwiki-Platform-Web-Templates

Xwiki-Web-Standard

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45134.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20962 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gr82-8fj2-ggc3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e · Patch
• https://osv.dev/vulnerability/CVE-2023-45134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45134 · Security Note
• https://osv.dev/vulnerability/GHSA-gr82-8fj2-ggc3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/72910 · Telegram Post