CVE-2021-21379: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store - Execution of Arbitrary Code
Summary
CVE-2021-21379: Impact The {{wikimacrocontent}} executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. Affects org.xwiki.platform:xwiki-platform-rendering-wikimacro-store across 3 version ranges.
>= 11.4, < 11.10.11
>= 12.0, < 12.6.3
>= 12.7, < 12.8
Fixed in 11.10.11, 12.6.3 or 12.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-rendering-wikimacro-store package is a component of XWiki, an open-source wiki software platform. It provides functionality for rendering wiki macros, which are used to extend the capabilities of the wiki. The package is written in Java and is commonly used in XWiki installations.
Vulnerability Detail
The vulnerability (CVE-2021-21379) in the org.xwiki.platform:xwiki-platform-rendering-wikimacro-store package allows for the execution of arbitrary code with the privileges of the author of a macro that uses the {{wikimacrocontent}} macro. When this macro is used, the content is executed with the rights of the wiki macro author, rather than the caller of the macro. This can be exploited to inject and execute malicious scripts with the privileges of the wiki macro author, who is often a user with programming rights. While the default XWiki Standard installation does not include this macro, it could have been created or installed through an extension.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 11.4, < 11.10.1111.10.11 -
>= 12.0, < 12.6.312.6.3 -
>= 12.7, < 12.812.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no easy workaround for this vulnerability other than disabling the affected macros. This can be done by removing or disabling any macros that use the {{wikimacrocontent}} macro. However, this may impact the functionality of certain macros and should be done with caution.
Conclusion
The org.xwiki.platform:xwiki-platform-rendering-wikimacro-store package in XWiki is vulnerable to the execution of arbitrary code through the {{wikimacrocontent}} macro. It is crucial to update to the patched versions (XWiki 12.6.3, 11.10.11, or 12.8-rc-1) or disable the affected macros to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-rendering-wikimacro-store →
FAQ
The vulnerability allows for the execution of arbitrary code with the privileges of the wiki macro author. This can lead to unauthorized access, data manipulation, or other malicious actions depending on the permissions of the affected user.
No, only versions between 11.4 and 11.10.11, and versions between 12.0 and 12.6.3 are affected. Versions 11.10.11 and 12.6.3 have been patched to address the vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the necessary patches or workarounds to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected macros are accessible to untrusted users. It is recommended to apply the necessary fixes to prevent potential remote exploitation.
For more information, you can refer to the XWiki Jira issue (https://jira.xwiki.org/browse/XWIKI-17759) related to this vulnerability. You can also contact the XWiki security mailing list (security@xwiki.org) for any questions or comments.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-rendering-wikimacro-store.
