Patchfirst
Patchfirst
CVE-2024-21650 Public exploit Critical · 10.0 EPSS 93.5%

XWiki Remote Code Execution vulnerability via user registration

xwiki · xwiki-platform

Summary

The XWiki Platform (xwiki-platform) contains a remote code execution flaw, classified as improper neutralization of directives in dynamically evaluated code, in its user registration feature. An attacker who can reach the registration form, which affects installations with guest user registration enabled, can run arbitrary code on the server by submitting a crafted payload in the first name or last name fields, with no authentication or user interaction required.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.

Breakdown
67.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 21 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+21 mo

5 fixes in xwiki-platform-administration-ui over 13 months. The latest fix listed for xwiki-platform-administration-ui is 16.3.0.

Fixes in xwiki-platform-administration-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 15.5.1CVE-2023-467316 Nov 2023
  2. 15.7-rc-1CVE-2023-5072215 Dec 2023
  3. 15.7-rc-1CVE-2023-5072315 Dec 2023
  4. 15.8-rc-1CVE-2024-216508 Jan 2024
  5. 16.3.0CVE-2024-5587912 Dec 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-administration-ui.

Mavenorg.xwiki.platform:xwiki-platform-administration-uiGHSA-rj7p-xjv7-7229

Upgrade to 15.5.3

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-46731).

Also affected, despite being newer: 15.6-rc-1 up to 15.8-rc-1.

Set the version to 15.5.3 or later in your pom.xml or build.gradle.

The first fix for CVE-2024-21650.

Affected versions, by release line

If you runUpgrade to
15.6-rc-1 up to 15.8-rc-115.8-rc-1
15.0-rc-1 up to 15.5.315.5.3
2.2 up to 14.10.1714.10.17

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9fcad0d31jira.xwiki.org/browse/XWIKI-21173
↑ ↓ chooseEnter openEsc close