CVE-2022-41931: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The patch can be manually applied by editing IconThemesCode.IconPickerMacro in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xwiki-platform-icon-uito a version that resolves this vulnerability.Fixed in 13.10.7 - Upgrade
Upgrade
xwiki-platform-icon-uito a version that resolves this vulnerability.Fixed in 14.5 - Upgrade
Upgrade
xwiki-platform-icon-uito a version that resolves this vulnerability.Fixed in 14.4.2 - Configuration
Workaround: Manually apply the patch by editing `IconThemesCode.IconPickerMacro` in the object editor, using the commit `47eb8a5fba550f477944eb6da8ca91b87eaf1d01` referenced for the fix.
XWiki icon picker macro IconThemesCode.IconPickerMacro (apply patch commit 47eb8a5fba550f477944eb6da8ca91b87eaf1d01) = manually edit to apply the referenced patch - Operational
If replacing the whole document instead of patching: Import the document from the XAR archive of a fixed version (since only security fixes and small formatting changes differ).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41931?
CVE-2022-41931 has a medium severity level due to its potential for code execution by authenticated users.
How do I fix CVE-2022-41931?
To fix CVE-2022-41931, update your XWiki installation to a version later than 14.4.4 or implement the recommended patches.
What types of code can be executed due to CVE-2022-41931?
CVE-2022-41931 allows execution of arbitrary Groovy, Python, or Velocity code due to improper neutralization of directives.
Who is affected by CVE-2022-41931?
Any user with view rights on commonly accessible documents, including the icon picker macro, can exploit CVE-2022-41931.
What versions of XWiki are affected by CVE-2022-41931?
CVE-2022-41931 affects XWiki versions from 6.4 up to 14.4.4, including specific milestones and revisions within those ranges.