CVE-2024-31986: XWiki Platform CSRF remote code execution through scheduler job's document reference
Impact By creating a document with a special crafted documented reference and an XWiki.SchedulerJobClass XObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki.
To reproduce on an XWiki installation, click on this link to create a new document : <xwiki-host>/xwiki/bin/view/%22%3E%5D%5D%7B%7B%2Fhtml%7D%7D%7B%7Basync%20context%3D%22request/parameters%22%7D%7D%7B%7Bvelocity%7D%7D%23evaluate%28%24request/eval%29/. Then, add to this document an object of type XWiki.SchedulerJobClass. Finally, as an admin, go to <xwiki-host>/xwiki/bin/view/Scheduler/?eval=$services.logging.getLogger(%22attacker%22).error(%22Hello%20from%20URL%20Parameter!%20I%20got%20programming:%20$services.security.authorization.hasAccess(%27programming%27)%22). If the logs contain ERROR attacker - Hello from URL Parameter! I got programming: true, the installation is vulnerable.
Patches The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9.
Workarounds Modify the Scheduler.WebHome page following this patch.
References - https://jira.xwiki.org/browse/XWIKI-21416 - https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c
Other sources
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an XWiki.SchedulerJobClass XObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, apply the patch manually by modifying the Scheduler.WebHome page.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31986?
CVE-2024-31986 has been classified with a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2024-31986?
To fix CVE-2024-31986, update the xwiki-platform-scheduler-ui to version 15.9, 15.5.4, or 14.10.19 or later.
Which versions of XWiki are affected by CVE-2024-31986?
CVE-2024-31986 affects XWiki versions between 3.1 and 15.5.4 and between 15.6 and 15.9.
What type of vulnerability is CVE-2024-31986?
CVE-2024-31986 is a remote code execution vulnerability that can be exploited when an admin user accesses the scheduler page.
Who is impacted by CVE-2024-31986?
Administrators who access the affected scheduler page in XWiki are primarily impacted by CVE-2024-31986.