Patchfirst
Patchfirst
CVE-2023-35150 Critical · 9.9 EPSS 77.7%

XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

xwiki · xwiki-platform

Summary

The XWiki Platform (xwiki-platform, the generic wiki runtime) contains an eval injection flaw in its Invitation application, which allows privilege escalation from view rights to programming rights. An attacker who has only view rights on a document, meaning a low-privileged authenticated user, can craft a URL containing a dangerous payload that is executed with programming rights, requiring no user interaction and only network access to the wiki.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.

Breakdown
26.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 23 Jun 2023. No public exploit code or confirmed exploitation is recorded.

See the family tree

3 related vulnerabilities in the same code over 4 months. The latest fix listed for xwiki-platform-invitation-ui is 15.2-rc-1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-29518Code injection from view right using Invitation.InvitationCommon…18 Apr 2023
  2. relatedHigh

    Why these are linked:

    • Fixed one release later14.10.1 → 14.10.4 (org.xwiki.platform:xwiki-platform-invitation-ui)
    • Same code patched: InvitationCommon.xml (machine-matched)commit 3d055a0commit b65220a
    This CVECVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view…23 Jun 2023
  3. relatedHigh

    Why these are linked:

    • Fixed one release later14.10.4 → 14.10.6 (org.xwiki.platform:xwiki-platform-invitation-ui)
    • Fixed one release later15.0 → 15.2-rc-1 (org.xwiki.platform:xwiki-platform-invitation-ui)
    • Same code patched: InvitationCommon.xml, InvitationConfig.xml (machine-matched)commit b65220acommit ff1d8a1
    CVE-2023-37914Privilege escalation (PR)/RCE from account through Invitation…17 Aug 2023

Fixes in xwiki-platform-invitation-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 14.10.1CVE-2023-2951818 Apr 2023
  2. 15.0CVE-2023-3515023 Jun 2023
  3. 15.2-rc-1CVE-2023-3791417 Aug 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-invitation-ui.

Mavenorg.xwiki.platform:xwiki-platform-invitation-uiGHSA-6mf5-36v9-3h2w

Upgrade to 15.0 or later

Set the version to 15.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-35150. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
15.0-rc-1 up to 15.015.0
14.5 up to 14.10.414.10.4
2.4-m-2 up to 14.4.814.4.8

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3ajira.xwiki.org/browse/XWIKI-20285
↑ ↓ chooseEnter openEsc close