Vulnerability · Published May 2, 2022 · Assigned by GitHub_M
CVE-2022-24897Arbitrary filesystem write access from Velocity
High 7.5
In plain English
A high-severity path traversal in xwiki-commons from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.commons:xwiki-commons-velocity | 12.6.7 | GHSA-cvx5-m8vg-vxgc |
| Maven | org.xwiki.commons:xwiki-commons-velocity | 12.10.3 | GHSA-cvx5-m8vg-vxgc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-commons | >= 2.3, < 12.6.712.7-rc-1, < 12.10.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-commons/pull/127 x_refsource_MISC
- https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-5168 x_refsource_MISC