CVE-2023-26477: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Summary
CVE-2023-26477: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability. Affects org.xwiki.platform:xwiki-platform-flamingo-theme-ui across 3 version ranges.
>= 6.2.4, < 13.10.10
>= 14.0, < 14.4.6
>= 14.5, < 14.9-rc-1
Fixed in 13.10.10, 14.4.6 or 14.9-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-flamingo-theme-ui package is a component of the XWiki Platform, an open-source wiki software written in Java. It provides the Flamingo theme user interface for XWiki. The Flamingo theme allows users to customize the appearance of their XWiki instance. However, a vulnerability has been discovered in the package that allows for arbitrary code injection.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-flamingo-theme-ui allows an attacker to inject arbitrary wiki syntax, including Groovy, Python, and Velocity script macros. This can be achieved by manipulating the 'newThemeName' request parameter in combination with the 'form_token' and 'action' parameters. By exploiting this vulnerability, an attacker can execute arbitrary code on the server, potentially leading to remote code execution and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.4, < 13.10.1013.10.10 -
>= 14.0, < 14.4.614.4.6 -
>= 14.5, < 14.9-rc-114.9-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is available. It involves manually editing the 'FlamingoThemesCode.WebHomeSheet' file and applying the changes from the patch provided by the XWiki project. The patch can be found at: https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284. It is important to carefully follow the instructions provided in the patch to ensure the vulnerability is properly mitigated.
Conclusion
The org.xwiki.platform:xwiki-platform-flamingo-theme-ui package is vulnerable to an eval injection vulnerability that allows for arbitrary code execution. It is crucial to update the package to one of the patched versions or apply the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to remote code execution and unauthorized access to sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to patch or mitigate the vulnerability as soon as possible to prevent potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can send a specially crafted request to the vulnerable server to execute arbitrary code.
Yes, the CVSS score for this vulnerability is 10.0, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui.
