Vulnerability · Published Jul 14, 2023 · Assigned by GitHub_M
CVE-2023-37462Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui
Critical 10.0
In plain English
A critical-severity injection in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 91.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-skin-ui | 14.4.8 | GHSA-h4vp-69r8-gvjg |
| Maven | org.xwiki.platform:xwiki-platform-skin-ui | 14.10.4 | GHSA-h4vp-69r8-gvjg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 7.0-rc-1, < 14.4.8>= 14.5, < 14.10.4 |
Weakness: CWE-74, CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20457 x_refsource_MISC