CVE-2022-36099: XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
Summary
CVE-2022-36099: XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability. Affects org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki across 2 version ranges.
>= 5.3-milestone-2, < 13.10.6
>= 14.0, < 14.4
Fixed in 13.10.6 or 14.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Platform Wiki UI Main Wiki is an open-source software package that provides a user interface for managing and editing wikis. It allows users to create, modify, and view wiki pages, as well as perform various administrative tasks. The package is widely used in both public read-only XWiki installations and private installations where users have accounts. However, a vulnerability has been discovered in the package that allows for arbitrary code execution and potential disclosure of sensitive information.
Vulnerability Detail
The vulnerability in the XWiki Platform Wiki UI Main Wiki allows an attacker to inject arbitrary wiki syntax, including Groovy, Python, and Velocity script macros, via a specially crafted request. This can be done by manipulating the URL parameters and exploiting the XWikiServerClassSheet component. If the user has view access to this sheet and another page with programming rights, the attacker can execute arbitrary code, bypassing all rights checks. This can lead to the modification and disclosure of all content stored in the XWiki installation, as well as potential impact on the availability of the wiki. The vulnerability has a CVSS score of 9.9, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3-milestone-2, < 13.10.613.10.6 -
>= 14.0, < 14.414.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For versions below 7.1 milestone 1, where the required escaping function is not available, a different fix would need to be developed. However, for XWiki versions 12.0 and later, users can import the document XWiki.XWikiServerClassSheet from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application. This will ensure that the necessary changes are applied to mitigate the vulnerability.
Conclusion
The XWiki Platform Wiki UI Main Wiki is vulnerable to an eval injection vulnerability that allows for arbitrary code execution and potential disclosure of sensitive information. It is critical to update your XWiki installation to the patched versions 13.10.6 or 14.4 to mitigate this vulnerability. Alternatively, you can apply the necessary changes manually or import the updated document from the provided XAR file. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki →
FAQ
The vulnerability allows an attacker to execute arbitrary code and bypass all rights checks in the XWiki installation. This can lead to the modification and disclosure of all content stored in the wiki, as well as potential impact on its availability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Simply enter the URL of your installation and the playground will analyze it for any known vulnerabilities.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to patch your XWiki installation as soon as possible to prevent any potential attacks.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the XWiki installation. However, the attacker would need to have view access to the XWikiServerClassSheet and another page with programming rights.
Yes, there is a workaround available for XWiki versions 12.0 and later. You can import the updated document XWiki.XWikiServerClassSheet from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki.
