GHSA-w7v9-fc49-4qg4

Source

https://github.com/advisories/GHSA-w7v9-fc49-4qg4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-w7v9-fc49-4qg4/GHSA-w7v9-fc49-4qg4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-w7v9-fc49-4qg4

Aliases

CVE-2023-29211

Published

2023-04-12T20:35:30Z

Modified

2023-11-01T05:01:48Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability

Details

Impact

Any user with view rights WikiManager.DeleteWiki can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the wikiId url parameter.

A proof of concept exploit is to open /xwiki/bin/view/WikiManager/DeleteWiki?wikiId=%22+%2F%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D where is the URL of your XWiki installation.

Patches

The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Workarounds

The issue can be fixed manually applying this patch.

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "cwe_ids": [
        "CWE-94",
        "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-12T20:35:30Z",
    "nvd_published_at": "2023-04-16T07:15:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki

Package

Name: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-wiki-ui-mainwiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3-milestone-2

Fixed

13.10.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-w7v9-fc49-4qg4/GHSA-w7v9-fc49-4qg4.json"

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki

Package

Name: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-wiki-ui-mainwiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0-rc-1

Fixed

14.4.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-w7v9-fc49-4qg4/GHSA-w7v9-fc49-4qg4.json"

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki

Package

Name: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-wiki-ui-mainwiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5

Fixed

14.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-w7v9-fc49-4qg4/GHSA-w7v9-fc49-4qg4.json"