PT-2023-8619 · Xwiki · Xwiki Admin Tools Application

Michael Hamann · Published 2023-11-20 · Updated 2023-11-29 · CVE-2023-48293

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Admin Tools Application versions prior to 4.5.1

Description A cross-site request forgery issue in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. This could be used to damage the wiki, create an account with elevated privileges for the attacker, and impact the confidentiality, integrity, and availability of the whole XWiki instance. A possible attack vector is through comments on the wiki by embedding an image with wiki syntax like [[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]], which could delete all documents from the database when an admin user views this comment.

Recommendations For versions prior to 4.5.1, update to Admin Tools Application 4.5.1, which includes a patch that adds form token checks to prevent the issue. As a temporary workaround, consider applying the patch manually to the affected pages. Alternatively, if the query tool is not needed, delete the document Admin.SQLToolsGroovy to deactivate all database query tools.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-01272

CVE-2023-48293

GHSA-4F4C-RHJV-4WGV

Affected Products

Xwiki Admin Tools Application

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48293.json · Exploit
• https://github.com/xwiki-contrib/application-admintools/commit/45298b4fbcafba6914537dcdd798a1e1385f9e46 · Patch
• https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-4f4c-rhjv-4wgv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48293 · Security Note
• https://osv.dev/vulnerability/GHSA-4f4c-rhjv-4wgv · Vendor Advisory
• https://jira.xwiki.org/browse/ADMINTOOL-92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48293 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01272 · Security Note
• https://github.com/xwiki-contrib/application-admintools · Note
• https://t.me/latest_high_impact_cve/101 · Telegram Post