Patchfirst
Patchfirst
CVE-2023-50721 Critical · 10.0 EPSS 78.8%

XWiki Platform RCE from account through SearchAdmin

xwiki · xwiki-platform

Summary

The XWiki Platform (xwiki-platform) has an improper escaping flaw in its search administration interface, where the id and label of search user interface extensions are not neutralised, allowing injected XWiki syntax containing script macros. An attacker with low-privileged, network-reachable access who can edit a wiki page (such as their own user profile, which is editable by default) and needs no user interaction can inject Groovy macros to execute code remotely, affecting the confidentiality, integrity and availability of the whole instance.

Official description · CVE.org

XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki instance. This attack can be executed by any user who can edit some wiki page like the user's profile (editable by default) as user interface extensions that will be displayed in the search administration can be added on any document by any user. The necessary escaping has been added in XWiki 14.10.15, 15.5.2 and 15.7RC1. As a workaround, the patch can be applied manually applied to the page `XWiki.SearchAdmin`.

Breakdown
26.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 15 Dec 2023. No public exploit code or confirmed exploitation is recorded.

4 fixes in xwiki-platform-search-ui over 8 months. The latest fix listed for xwiki-platform-search-ui is 15.10.2.

Fixes in xwiki-platform-search-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 15.7-rc-1CVE-2023-5072115 Dec 2023
  2. 15.10-rc-1CVE-2024-3146510 Apr 2024
  3. 15.10-rc-1CVE-2024-3198210 Apr 2024
  4. 15.10.2CVE-2024-3790131 Jul 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-search-ui.

Mavenorg.xwiki.platform:xwiki-platform-search-uiGHSA-7654-vfh6-rw6x

Upgrade to 15.5.4

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2024-31465, CVE-2024-31982).

Also affected, despite being newer: 15.6-rc-1 up to 15.7-rc-1.

Set the version to 15.5.4 or later in your pom.xml or build.gradle.

First fixed in 15.5.2 for CVE-2023-50721.

Affected versions, by release line

If you runUpgrade to
15.6-rc-1 up to 15.7-rc-115.10-rc-1first fix for this CVE: 15.7-rc-1
15.0-rc-1 up to 15.5.215.5.4first fix for this CVE: 15.5.2
4.5-rc-1 up to 14.10.1514.10.20first fix for this CVE: 14.10.15

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-7654-vfh6-rw6x

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/62863736d78ffd60d822279c5fb7fb9593042766jira.xwiki.org/browse/XWIKI-21200
↑ ↓ chooseEnter openEsc close