PT-2024-29986 · Unknown+1 · Pro Macros+1

Michitux · Published 2024-08-12 · Updated 2024-09-16 · CVE-2024-42489

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pro Macros versions prior to 1.10.1

Description The issue is related to missing escaping in the Viewpdf macro, which allows any user with view right on the CKEditor.HTMLConverter page or edit or comment right on any page to perform remote code execution. Other macros, such as Viewppt, are vulnerable to the same kind of attack.

Recommendations For versions prior to 1.10.1, update to version 1.10.1 to patch this security flaw. As a temporary workaround, consider disabling the Viewpdf macro and other vulnerable macros, such as Viewppt, until a patch is available. Restrict access to the CKEditor.HTMLConverter page to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-42489

GHSA-CFQ3-Q227-7J65

Affected Products

Ckeditor

Pro Macros

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42489.json · Exploit
• https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65 · Vendor Advisory
• https://github.com/xwikisas/xwiki-pro-macros/commit/199553c84901999481a20614f093af2d57970eba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42489 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42489 · Vendor Advisory
• https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267 · Note
• https://twitter.com/CVEnew/status/1823031349755998411 · Twitter Post
• https://t.me/cvedetector/2862 · Telegram Post
• https://twitter.com/oktsec/status/1824766653776769326 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823033092665159743 · Twitter Post
• https://twitter.com/CveFindCom/status/1823027194924278021 · Twitter Post