PT-2024-24338 · Xwiki · Xwiki Platform

Pierre Jeanjean · Published 2024-04-10 · Updated 2025-01-09 · CVE-2024-31988

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.9-rc-1 through 4.10.18 XWiki Platform versions 13.9-rc-1 through 15.5.3 XWiki Platform versions 13.9-rc-1 through 15.10-rc-1

Description The XWiki Platform is a generic wiki platform that allows arbitrary remote code execution with the interaction of an admin user with programming right when the realtime editor is installed. This is achieved by getting an admin user to either visit a crafted URL or to view an image with this URL that could be in a comment, allowing the attacker to execute arbitrary XWiki syntax including scripting macros with Groovy or Python code. This compromises the confidentiality, integrity, and availability of the whole XWiki installation.

To test for the vulnerability, an admin can click on the "/xwiki/bin/get/RTFrontend/ConvertHTML?wiki=xwiki&space=Main&page=WebHome&text=%7B%7Bvelocity%7D%7D%24logtool.error%28%22Hello%20from%20Velocity%20%21%22%29%7B%7B%2Fvelocity%7D%7D" API endpoint. If the error "Hello from Velocity!" gets logged, then the installation is vulnerable.

Recommendations For XWiki Platform versions 13.9-rc-1 through 4.10.18, update to version 4.10.19 or later. For XWiki Platform versions 13.9-rc-1 through 15.5.3, update to version 15.5.4 or later. For XWiki Platform versions 13.9-rc-1 through 15.10-rc-1, update to version 15.10 or later. As a temporary workaround, one may update RTFrontend.ConvertHTML manually with the patch, but this will break some synchronization processes in the realtime editor.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-31988

GHSA-R5VH-GC3R-R24W

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31988.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-21424 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5vh-gc3r-r24w · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/d88da4572fb7d4f95e1f54bb0cce33fce3df08d9 · Patch
• https://github.com/xwiki/xwiki-platform/commit/d9f5043da289ff106f08e23576746fd8baf98794 · Patch
• https://github.com/xwiki/xwiki-platform/commit/9f8cc88497418750b09ce9fde5d67d840f038fbf · Patch
• https://github.com/xwiki/xwiki-platform/commit/4896712ee6483da623f131be2e618f1f2b79cb8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31988 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31988 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5vh-gc3r-r24w · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/106969 · Telegram Post
• https://twitter.com/CVEnew/status/1778263595278807466 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778199584407236980 · Twitter Post