PT-2024-24334 · Xwiki · Xwiki Platform

Michael Hamann · Published 2024-04-10 · Updated 2025-01-21 · CVE-2024-31983

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.3-milestone-2 through 4.10.19 XWiki Platform versions prior to 15.5.4 XWiki Platform versions prior to 15.10-rc-1

Description In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations. This can be exploited for remote code execution if the translation value is not properly escaped where it is used. For example, editing a translation of AppWithinMinutes.Translations and adding {{async}}{{groovy}}println("Hello from Translation"){{/groovy}}{{/async}} at the end of the line platform.appwithinminutes.description= can demonstrate the vulnerability.

Recommendations For XWiki Platform versions 4.3-milestone-2 through 4.10.19, update to version 4.10.20 or later. For XWiki Platform versions prior to 15.5.4, update to version 15.5.4 or later. For XWiki Platform versions prior to 15.10-rc-1, update to version 15.10-rc-1 or later. As a temporary workaround, restrict edit rights on documents that contain translations.

Exploit

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-31983

GHSA-XXP2-9C9G-7WMJ

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31983.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-21411 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xxp2-9c9g-7wmj · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/2a9ce88f33663c53c9c63b2ea573f4720ea2efb9 · Patch
• https://github.com/xwiki/xwiki-platform/commit/c4c8d61c30de72298d805ccc82df2a307f131c54 · Patch
• https://github.com/xwiki/xwiki-platform/commit/73aef9648bbff04b697837f1b906932f0d5caacb · Patch
• https://osv.dev/vulnerability/CVE-2024-31983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31983 · Security Note
• https://osv.dev/vulnerability/GHSA-xxp2-9c9g-7wmj · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/76425 · Telegram Post
• https://twitter.com/CVEnew/status/1778263601842917822 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778201104045506881 · Twitter Post
• https://t.me/cvenotify/108050 · Telegram Post