CVE-2024-55879: XWiki allows RCE from script right in configurable sections
Impact Any user with script rights can perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on a instance, as a user with script rights, edit your user profile and add an object of type XWiki.ConfigurableClass ("Custom configurable sections"). Set "Display in section" and "Display in category" to other, "Scope" to Wiki and all spaces and "Heading" to: #set($codeToExecute = 'Test') #set($codeToExecuteResult = '{{async}}{{groovy}}services.logging.getLogger("attacker").error("Attack from Heading succeeded!"){{/groovy}}{{/async}}') Save the page and view it, then add ?sheet=XWiki.AdminSheet&viewer=content§ion=other to the URL. If the logs contain "attacker - Attack from Heading succeeded!", then the instance is vulnerable.
Patches This has been patched in XWiki 15.10.9 and 16.3.0.
Workarounds We're not aware of any workaround except upgrading.
References https://jira.xwiki.org/browse/XWIKI-21207 https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55879?
CVE-2024-55879 is rated as a critical vulnerability due to its potential for arbitrary remote code execution.
How do I fix CVE-2024-55879?
To fix CVE-2024-55879, upgrade to XWiki platform version 16.3.0 or 15.10.9.
What impact does CVE-2024-55879 have on my XWiki installation?
CVE-2024-55879 compromises the confidentiality, integrity, and availability of the entire XWiki installation.
Who is affected by CVE-2024-55879?
Any user with script rights on XWiki installations using vulnerable versions of the platform is affected by CVE-2024-55879.
What are the affected versions for CVE-2024-55879?
CVE-2024-55879 affects XWiki platform versions from 2.3 up to 15.10.9 and from 16.0.0-rc-1 to 16.3.0.