CVE-2020-15171: Arbitrary Code Execution in XWiki
Summary
CVE-2020-15171: Users with SCRIPT right can execute arbitrary code in XWiki. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 11.10.5
>= 12.0.0, < 12.2.1
Fixed in 11.10.5 or 12.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XWiki is an open-source platform for developing collaborative applications. It provides a wiki-like environment where users can create, edit, and share content. The XWiki platform is built on top of the XWiki Core, which is responsible for the core functionality of the application. The XWiki Core includes various modules and components that handle user authentication, content storage, and access control. The XWiki platform is widely used in organizations for knowledge management, documentation, and collaboration purposes.
Vulnerability Detail
The vulnerability identified as CVE-2020-15171 allows users with the SCRIPT right (EDIT right before XWiki 7.4) to execute arbitrary code in XWiki. This means that an attacker with the SCRIPT right can gain access to the application server Servlet context, which contains tools that allow the instantiation of arbitrary Java objects and the invocation of methods that may lead to arbitrary code execution. The impact of this vulnerability is significant as it allows an attacker to execute malicious code on the server, potentially compromising the confidentiality, integrity, and availability of the XWiki application and its underlying infrastructure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 11.10.511.10.5 -
>= 12.0.0, < 12.2.112.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating XWiki is not immediately feasible, a temporary workaround is to restrict the SCRIPT right to trusted users only. By limiting the access to the SCRIPT right, the risk of unauthorized code execution can be mitigated. However, this workaround should be considered temporary, and it is still recommended to update XWiki to the latest patched version as soon as possible.
Conclusion
CVE-2020-15171 is a critical vulnerability in XWiki that allows users with the SCRIPT right to execute arbitrary code on the server. It is crucial for XWiki users to update to the latest patched version (12.2.1 or 11.10.5) to mitigate the risk of unauthorized code execution. Additionally, restricting the SCRIPT right to trusted users can provide temporary mitigation until the update is applied. Regularly updating XWiki and applying security patches is essential to ensure the security and integrity of the application and its underlying infrastructure.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The impact of CVE-2020-15171 is significant as it allows an attacker to execute arbitrary code on the XWiki server. This can lead to various consequences, including unauthorized access to sensitive information, data manipulation, and disruption of the XWiki application and its underlying infrastructure.
Any organization or individual using XWiki versions prior to 12.2.1 or 11.10.5 is potentially affected by this vulnerability. It is recommended for all XWiki users to update to the latest patched version to mitigate the risk.
At the time of this advisory, there are no known public exploits specifically targeting CVE-2020-15171. However, it is important to note that the existence of a vulnerability increases the risk of exploitation, and it is crucial to apply the necessary patches and security measures to protect against potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker with the SCRIPT right can execute arbitrary code by sending specially crafted requests to the XWiki application. It is important to secure the XWiki application behind appropriate network defenses and apply the recommended patches to prevent remote exploitation.
Updating XWiki to the latest patched version is the recommended solution to fix this vulnerability. However, if immediate update is not feasible, restricting the SCRIPT right to trusted users can provide temporary mitigation. It is important to note that this workaround should only be considered temporary, and updating XWiki should be prioritized.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
