CVE-2023-29521: Code injection from account/view through VFS Tree macro in xwiki-platform
Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Macro.VFSTreeMacro. This page is not installed by default.
See https://jira.xwiki.org/browse/XWIKI-20260 for the reproduction steps.
Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11.
Workarounds The issue can be fixed by applying this patch on Macro.VFSTreeMacro.
References - https://jira.xwiki.org/browse/XWIKI-20260 - https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12
For more information
If you have any questions or comments about this advisory:
Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Macro.VFSTreeMacro. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-29521?
CVE-2023-29521 is a vulnerability in XWiki Platform that allows any user with view rights to execute arbitrary Groovy, Python, or Velocity code, leading to full access to the XWiki installation.
What is the severity of CVE-2023-29521?
CVE-2023-29521 has a severity score of 8.8, which is considered high.
How can the CVE-2023-29521 vulnerability be exploited?
The CVE-2023-29521 vulnerability can be exploited by any user with view rights executing arbitrary Groovy, Python, or Velocity code in XWiki.
Which software versions are affected by CVE-2023-29521?
XWiki versions up to 13.10.11 and versions between 14.0 and 14.4.8 are affected by CVE-2023-29521.
Is there a fix for CVE-2023-29521?
Yes, a fix for CVE-2023-29521 is available. It is recommended to update to XWiki version 14.4.8 (for versions up to 13.10.11) or version 14.10.2 (for versions between 14.0 and 14.4.8).