CVE-2024-55662: XWiki allows remote code execution through the extension sheet
Impact On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type ExtensionCode.ExtensionClass. Set the description to {{async}}{{groovy}}println("Hello from Description"){{/groovy}}{{/async}} and press Save and View. If the description displays as Hello from Description without any error, then the instance is vulnerable.
Patches This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0.
Workarounds Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it. It is also possible to manually apply this patch to the page ExtensionCode.ExtensionSheet, as well as this patch to the page ExtensionCode.ExtensionAuthorsDisplayer.
References https://jira.xwiki.org/browse/XWIKI-21890 https://github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page ExtensionCode.ExtensionSheet and to the page ExtensionCode.ExtensionAuthorsDisplayer.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55662?
CVE-2024-55662 is rated as critical due to its potential to allow unauthorized code execution by any user with access to the Extension Repository Application.
How do I fix CVE-2024-55662?
To remediate CVE-2024-55662, upgrade to version 16.3.0 or 15.10.9 of the affected XWiki packages immediately.
What software is affected by CVE-2024-55662?
CVE-2024-55662 affects XWiki versions 16.0.0-rc-1 to 16.3.0 and 3.3-milestone-1 to 15.10.9 of the xwiki-platform-repository-server-ui package.
Who can exploit CVE-2024-55662?
Any user with normal access to the server and the Extension Repository Application can exploit CVE-2024-55662 to execute arbitrary code.
What kind of impact does CVE-2024-55662 have?
The impact of CVE-2024-55662 includes unauthorized code execution, which can compromise server integrity and confidentiality.