CVE-2024-31985: XWiki Platform CSRF in the job scheduler
Impact It is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image.
To reproduce in an XWiki installation, open <xwiki-host>:/xwiki/bin/view/Scheduler/?do=trigger&which=Scheduler.NotificationEmailDailySender as a user with admin rights. If there is no error message that indicates the CSRF token is invalid, the installation is vulnerable.
Patches The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9.
Workarounds Modify the Scheduler.WebHome page following this patch.
References - https://jira.xwiki.org/browse/XWIKI-20851 - https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c
Other sources
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the Scheduler.WebHome page.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31985?
The severity of CVE-2024-31985 is classified as a medium vulnerability.
How do I fix CVE-2024-31985?
To fix CVE-2024-31985, upgrade to version 15.9, 15.5.4, or 14.10.19 of the affected XWiki packages.
What software is affected by CVE-2024-31985?
CVE-2024-31985 affects multiple versions of the XWiki platform, specifically those from 3.1 to 15.9.
What are the consequences of CVE-2024-31985?
If exploited, CVE-2024-31985 allows unauthorized scheduling and unscheduling of jobs by accessing a predictable URL.
Can CVE-2024-31985 be exploited remotely?
Yes, CVE-2024-31985 can be exploited remotely if an administrator is tricked into visiting a malicious URL.