CVE-2024-31987: XWiki Platform remote code execution from account via custom skins support
Impact Any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution.
To reproduce, as a user without edit, script or admin right, add an object of class XWiki.XWikiSkins to your profile. Name it whatever you want and set the Base Skin to flamingo. Add an object of class XWikiSkinFileOverrideClass and set the path to macros.vm and the content to: #macro(mediumUserAvatar $username) #resizedUserAvatar($username 50) $services.logging.getLogger('Skin').error("I got programming: $services.security.authorization.hasAccess('programming')") #end Back to your profile, click Test this skin. Force a refresh, just in case. If the error "Skin - I got programming: true" gets logged, the installation is vulnerable.
Patches This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1.
Workarounds We're not aware of any workaround except upgrading.
References https://jira.xwiki.org/browse/XWIKI-21478 https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39 (>= 15.8 RC1) https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56 (< 15.8 RC1)
Other sources
XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31987?
CVE-2024-31987 has a high severity level due to its potential for remote code execution via template overrides.
How do I fix CVE-2024-31987?
To fix CVE-2024-31987, upgrade to XWiki versions 15.10-rc-1, 15.5.4, or 14.10.19 as they contain the necessary patches.
What software is affected by CVE-2024-31987?
CVE-2024-31987 affects multiple versions of XWiki, specifically those between 6.4 and 15.10.
Can any user exploit CVE-2024-31987?
Yes, any user with page editing capabilities can exploit CVE-2024-31987 to create a custom skin that triggers remote code execution.
What kind of vulnerability is CVE-2024-31987?
CVE-2024-31987 is classified as a remote code execution vulnerability due to improper handling of template overrides.