CVE-2024-21651: XWiki Denial of Service attack through attachments
Impact
A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption.
Patches This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.
Workarounds
The workaround is to download commons-compress 1.24 and replace the one located in XWiki WEB-INF/lib/ folder.
References
https://jira.xwiki.org/browse/XCOMMONS-2796
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-distribution-warto a version that resolves this vulnerability.Fixed in 15.8-rc-1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-distribution-warto a version that resolves this vulnerability.Fixed in 15.5.3 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-distribution-warto a version that resolves this vulnerability.Fixed in 14.10.18 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 14.10.18 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 15.5.3 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 15.8 RC1 - Compensating control
Workaround: download commons-compress 1.24 and replace the commons-compress JAR located in XWiki `WEB-INF/lib/` with commons-compress 1.24.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21651?
CVE-2024-21651 is classified as a denial of service vulnerability due to potential CPU consumption from malformed TAR file processing.
How do I fix CVE-2024-21651?
To mitigate CVE-2024-21651, upgrade to XWiki version 14.10.18, 15.5.3, or 15.8-rc-1.
Which versions of XWiki are affected by CVE-2024-21651?
CVE-2024-21651 affects XWiki versions between 14.10.0 and 14.10.18, and 15.0-rc-1 to 15.5.3.
Does CVE-2024-21651 impact all XWiki installations?
CVE-2024-21651 impacts XWiki installations that allow users to upload and attach files to pages.
What type of attack does CVE-2024-21651 enable?
CVE-2024-21651 enables a denial of service attack that could lead to excessive CPU usage.