PT-2023-8611 · Xwiki · Xwiki Platform
Michael Hamann
·
Published
2023-04-18
·
Updated
2023-04-28
·
CVE-2023-29522
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
XWiki Platform versions prior to 14.4.8
XWiki Platform versions prior to 14.10.3
XWiki Platform versions prior to 15.0RC1
Description
The issue allows any user with view rights to execute arbitrary script macros, including Groovy and Python macros, which can lead to remote code execution and unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. For instance, an attacker can exploit this by opening a page with a crafted URL, such as
Open <xwiki-host>/xwiki/bin/view/%22%2F%7D%7D%7B%7B%2Fhtml%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=XWiki.ClassSheet&xpage=view, where <xwiki-host> is the URL of the XWiki installation.Recommendations
To resolve the issue for versions prior to 14.4.8, upgrade to XWiki 14.4.8 or later.
To resolve the issue for versions prior to 14.10.3, upgrade to XWiki 14.10.3 or later.
To resolve the issue for versions prior to 15.0RC1, upgrade to XWiki 15.0RC1 or later.
As a temporary workaround, consider restricting access to the
groovy and python macros until a patch is applied.Exploit
Fix
RCE
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xwiki Platform