Remote code execution through the section parameter in Administration as guest in XWiki Platform
xwiki · xwiki-platform
A flaw in the section URL parameter used to display administration sections in XWiki Platform (xwiki-platform) allows code injection because the parameter is not properly escaped. An attacker with network access and no authentication or user interaction can exploit it, since the vulnerable document XWiki.AdminSheet is readable by default, including by guests, to execute arbitrary code such as Groovy.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document `XWiki.AdminSheet` (by default, everyone including unauthenticated users) to execute code including Groovy code. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This vulnerability has been patched in XWiki 14.10.14, 15.6 RC1 and 15.5.1. Users are advised to upgrade. Users unablr to upgrade may apply the fix in commit `fec8e0e53f9` manually. Alternatively, to protect against attacks from unauthenticated users, view right for guests can be removed from this document (it is only needed for space and wiki admins).
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 6 Nov 2023. No public exploit code or confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in xwiki-platform-administration-ui over 9 months. The latest fix listed for xwiki-platform-administration-ui is 15.8-rc-1.
Fixes in xwiki-platform-administration-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 14.10.1CVE-2023-2951116 Apr 2023
- 14.10.1CVE-2023-2951418 Apr 2023
- 14.10.2CVE-2023-2951018 Apr 2023
- 15.5.1CVE-2023-467316 Nov 2023
- 15.7-rc-1CVE-2023-5072215 Dec 2023
- 15.7-rc-1CVE-2023-5072315 Dec 2023
- 15.8-rc-1CVE-2024-216508 Jan 2024Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.xwiki.platform:xwiki-platform-administration-uiAffected: 15.0-rc-1 up to 15.5.1; All versions before 14.10.14Upgrade to 15.5.3 or later (older lines: 14.10.17)
- Mavenorg.xwiki.platform:xwiki-platform-administrationAffected: All versions before 14.10.14Upgrade to 14.10.14 or later