CVE-2022-24897: Arbitrary Filesystem Write Access from Velocity in org.xwiki.commons:xwiki-commons-velocity
Summary
CVE-2022-24897: Arbitrary filesystem write access from velocity. Affects org.xwiki.commons:xwiki-commons-velocity across 2 version ranges.
>= 2.3.0, < 12.6.7
>= 12.7.0, < 12.10.3
Fixed in 12.6.7 or 12.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.commons:xwiki-commons-velocity package is a Maven package that provides functionality for Velocity scripting in XWiki. Velocity is a template engine that allows users to dynamically generate web pages, emails, and other text-based content. It is commonly used in web application development to separate the presentation layer from the business logic. However, the package is vulnerable to an arbitrary filesystem write access issue when using Velocity scripts in XWiki.
Vulnerability Detail
The vulnerability allows an attacker to perform unauthorized read or write operations on the filesystem through Velocity scripts in XWiki. This can lead to various security risks, such as unauthorized access to sensitive files, modification of critical system files, or execution of arbitrary code. The issue arises due to the lack of proper sandboxing of Velocity scripts against using the Java File API. Although exploiting this vulnerability requires Script rights in XWiki and finding an XWiki API that returns a File, it still poses a significant threat to the system's integrity and confidentiality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 12.6.712.6.7 -
>= 12.7.0, < 12.10.312.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no easy workaround for fixing this vulnerability other than upgrading to the patched versions. However, it is crucial to be cautious when granting Script rights in XWiki and to ensure that only trusted users have access to this privilege.
Conclusion
The org.xwiki.commons:xwiki-commons-velocity package is vulnerable to arbitrary filesystem write access from Velocity scripts in XWiki. This can lead to unauthorized access, file modification, or code execution. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.commons:xwiki-commons-velocity →
FAQ
The vulnerability allows an attacker to perform unauthorized read or write operations on the filesystem through Velocity scripts in XWiki. This can lead to unauthorized access to sensitive files, modification of critical system files, or execution of arbitrary code.
Users of the org.xwiki.commons:xwiki-commons-velocity package in versions prior to 12.6.7, 12.10.3, and 13.0RC1 are affected by this vulnerability.
There is no easy workaround for fixing this vulnerability other than upgrading to the patched versions of the package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
You can find more information about this vulnerability in the XWiki Jira issue XWIKI-5168 (https://jira.xwiki.org/browse/XWIKI-5168).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.commons:xwiki-commons-velocity.
