CVE-2023-29211: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
Summary
CVE-2023-29211: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability. Affects org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki across 3 version ranges.
>= 5.3-milestone-2, < 13.10.11
>= 14.0-rc-1, < 14.4.7
>= 14.5, < 14.10
Fixed in 13.10.11, 14.4.7 or 14.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki package is a component of the XWiki platform, which is an open-source wiki software written in Java. It provides a user interface for managing and interacting with wiki pages. The package is used to handle operations related to the main wiki in XWiki installations.
Vulnerability Detail
The vulnerability identified as CVE-2023-29211 allows any user with view rights WikiManager.DeleteWiki to execute arbitrary Groovy, Python, or Velocity code in XWiki, leading to full access to the XWiki installation. The issue arises from improper escaping of the wikiId URL parameter. An attacker can exploit this vulnerability by manipulating the wikiId parameter to inject and execute malicious code. The impact of this vulnerability is severe as it grants unauthorized access to the XWiki installation, potentially compromising sensitive data and system integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3-milestone-2, < 13.10.1113.10.11 -
>= 14.0-rc-1, < 14.4.714.4.7 -
>= 14.5, < 14.1014.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround can be implemented by manually applying the provided patch. The patch can be found at the following URL: Patch. This workaround should be used until the XWiki installation can be updated to one of the patched versions.
Conclusion
The org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability (CVE-2023-29211) allows unauthorized execution of arbitrary code in XWiki, potentially leading to full access to the XWiki installation. It is crucial to update the XWiki installation to one of the patched versions (13.10.11, 14.4.7, or 14.10) or apply the provided patch to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki →
FAQ
The vulnerability allows an attacker to execute arbitrary code in XWiki, leading to full access to the XWiki installation. This can result in unauthorized access to sensitive data, system compromise, and potential further exploitation.
Any XWiki installation that uses the org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki package and has users with view rights WikiManager.DeleteWiki is affected by this vulnerability.
Yes, a proof of concept exploit has been provided in the vulnerability details. It demonstrates how an attacker can execute arbitrary Groovy, Python, or Velocity code by manipulating the wikiId URL parameter.
Yes, the vulnerability has been patched in XWiki versions 13.10.11, 14.4.7, and 14.10. It is recommended to update the XWiki installation to one of these patched versions to mitigate the vulnerability.
If you suspect that your XWiki installation is affected by this vulnerability, it is recommended to update to one of the patched versions (13.10.11, 14.4.7, or 14.10) or apply the provided patch manually. Additionally, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki.
