CVE-2023-35150: XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
Impact Any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. See the example below: Open <xwiki-host>/xwiki/bin/view/%5D%5D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=Invitation.InvitationGuestActions&xpage=view where <xwiki-host> is the URL of your XWiki installation.
Patches The problem as been patching on XWiki 15.0, 14.10.4 and 14.4.8.
Workarounds It is possible to partially fix the issue by applying this patch. Note that some additional issue can remain and can be fixed automatically by a migration. Hence, it is advised to upgrade to one of the patched version instead of patching manually.
References - https://jira.xwiki.org/browse/XWIKI-20285
For more information
If you have any questions or comments about this advisory:
Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-invitation-uito a version that resolves this vulnerability.Fixed in 15.0 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-invitation-uito a version that resolves this vulnerability.Fixed in 14.10.4 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-invitation-uito a version that resolves this vulnerability.Fixed in 14.4.8 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 15.0 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.10.4 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.4.8 - Compensating control
To mitigate CVE-like impact of RCE via crafted URLs, apply the partial fix patch commit b65220a4d86b8888791c3b643074ebca5c089a3a from xwiki/xwiki-platform. (This is described as a partial fix; full remediation is via upgrading to the patched versions.)
- Operational
Run the automatic migration mentioned in the advisory to address any additional remaining issues after applying the fix/upgrade.
Event History
Frequently Asked Questions
What is CVE-2023-35150?
CVE-2023-35150 is a vulnerability in XWiki Platform that allows any user with view rights on any document to execute code with programming rights, leading to remote code execution.
What is the severity of CVE-2023-35150?
CVE-2023-35150 has a severity level of critical.
How does CVE-2023-35150 affect XWiki Platform?
CVE-2023-35150 affects XWiki Platform versions 2.40m-2 to 14.4.8, 14.10.4, and 15.0.
Is there a fix for CVE-2023-35150?
Yes, the fix for CVE-2023-35150 is available in XWiki Platform versions 14.4.8, 14.10.4, and 15.0.
Where can I find more information about CVE-2023-35150?
You can find more information about CVE-2023-35150 in the references provided: [Reference 1](https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a), [Reference 2](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w), [Reference 3](https://jira.xwiki.org/browse/XWIKI-20285).