PT-2024-4286 · Xwiki · Xwiki Platform

Michael Hamann · Published 2024-06-20 · Updated 2024-06-24 · CVE-2024-37899

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6 XWiki Platform versions prior to 16.0.0

Description The issue is related to incorrect privilege assignment in the XWiki Platform, allowing a remote attacker to execute arbitrary code. When an admin disables a user account, the user's profile is executed with the admin's rights, enabling a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce the issue, a user without script or programming rights can edit the about section of their user profile and add {{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}. Then, as an admin, go to the user profile and click the "Disable this account" button, and reload the page. If the logs show attacker - Hello from Groovy!, then the instance is vulnerable.

Recommendations To resolve the issue for versions prior to 14.10.21, upgrade to version 14.10.21 or later. To resolve the issue for versions prior to 15.5.5, upgrade to version 15.5.5 or later. To resolve the issue for versions prior to 15.10.6, upgrade to version 15.10.6 or later. To resolve the issue for versions prior to 16.0.0, upgrade to version 16.0.0 or later.

Exploit

Fix

Code Injection

Incorrect Privilege Assignment

Weakness Enumeration

CWE-94

CWE-266

Related Identifiers

BDU:2024-04773

CVE-2024-37899

GHSA-J584-J2VJ-3F93

Affected Products

Xwiki Platform

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37899.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j584-j2vj-3f93 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a · Patch
• https://jira.xwiki.org/browse/XWIKI-21611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j584-j2vj-3f93 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04773 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37899 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37899 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/2b55c29562ccd20f8f0f85075f0c95b4ee9cd9be · Note
• https://github.com/xwiki/xwiki-platform/commit/f8409419c5d0ddefe1bee55e73629a54275fa735 · Note
• https://github.com/xwiki/xwiki-platform/commit/046c36519a2df392c922c16d0d38472b98c414d0 · Note
• https://github.com/xwiki/xwiki-platform/commit/233b08b26580df4b7a595882dac65ed4e4a2419c · Note
• https://github.com/advisories/GHSA-j584-j2vj-3f93 · Note
• https://twitter.com/CveFindCom/status/1803918606398329205 · Twitter Post