CVE-2023-29522: Code injection from view right on XWiki.ClassSheet in xwiki-platform
First published: Tue Apr 18 2023(Updated: )
### Impact Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. For instance: `Open <xwiki-host>/xwiki/bin/view/%22%2F%7D%7D%7B%7B%2Fhtml%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=XWiki.ClassSheet&xpage=view`, where `<xwiki-host>` is the URL of your XWiki installation. ### Patches This has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1. ### Workarounds The fix is only impacting Velocity templates and page contents, so applying this [patch](https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee) is enough to fix the issue. ### References - https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee - https://jira.xwiki.org/browse/XWIKI-20456 ### For more information If you have any questions or comments about this advisory: - Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) - Email us at [Security Mailing List](mailto:security@xwiki.org)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki Xwiki | <14.4.8 | |
| Xwiki Xwiki | >=14.5<14.10.3 | |
| maven/org.xwiki.platform:xwiki-platform-xclass-ui | >=14.5<14.10.3 | 14.10.3 |
| maven/org.xwiki.platform:xwiki-platform-xclass-ui | >=7.0-rc-1<14.4.8 | 14.4.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mjw9-3f9f-jq2w
- https://jira.xwiki.org/browse/XWIKI-20456
- https://nvd.nist.gov/vuln/detail/CVE-2023-29522
- https://github.com/advisories/GHSA-mjw9-3f9f-jq2w (Advisory)
Frequently Asked Questions
What is CVE-2023-29522?
CVE-2023-29522 is a vulnerability in XWiki Platform that allows any user with view rights to execute arbitrary script macros and achieve remote code execution.
What is the severity of CVE-2023-29522?
CVE-2023-29522 has a severity rating of critical.
How does CVE-2023-29522 impact XWiki Platform?
CVE-2023-29522 allows users to execute arbitrary script macros, including Groovy and Python macros, which can lead to remote code execution and unrestricted access to all wiki contents.
Which versions of XWiki Platform are affected by CVE-2023-29522?
XWiki Platform versions up to 14.4.8 and versions between 14.5 and 14.10.3 are affected by CVE-2023-29522.
How can I fix CVE-2023-29522?
To fix CVE-2023-29522, users should update to a version of XWiki Platform that includes the patch provided by the vendor.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-mjw9-3f9f-jq2w
- alias/CVE-2023-29522
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/xwiki
- canonical/xwiki xwiki
- version/xwiki xwiki/14.5
- package-manager/maven