CVE-2023-29509: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Summary
CVE-2023-29509: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability. Affects org.xwiki.platform:xwiki-platform-flamingo-theme-ui across 3 version ranges.
>= 7.2-rc-1, < 13.10.11
>= 14.0-rc-1, < 14.4.7
>= 14.5, < 14.10
Fixed in 13.10.11, 14.4.7 or 14.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-flamingo-theme-ui package is a Maven package that provides the Flamingo theme UI for XWiki installations. XWiki is an open-source collaboration platform that allows users to create and share content. The Flamingo theme UI is a default theme installed in XWiki. This package is vulnerable to an Eval Injection vulnerability, which allows an attacker with view rights on commonly accessible documents to execute arbitrary Groovy, Python, or Velocity code in XWiki, potentially leading to full access to the XWiki installation.
Vulnerability Detail
The vulnerability arises from improper escaping of the documentTree macro parameters in the FlamingoThemesCode.WebHome page. This macro is installed by default in the FlamingoThemesCode.WebHome page, which is accessible to users with view rights. By crafting a specific URL, an attacker can inject and execute arbitrary code in the context of the XWiki installation. This can lead to privilege escalation from view to programming rights, allowing the attacker to gain full control over the XWiki installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.2-rc-1, < 13.10.1113.10.11 -
>= 14.0-rc-1, < 14.4.714.4.7 -
>= 14.5, < 14.1014.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, the code of the FlamingoThemesCode.WebHome page can be replaced with the patched version provided in the XWiki GitHub repository. This can be done by navigating to the FlamingoThemesCode.WebHome page in the XWiki administration interface, selecting the 'Edit' option, and replacing the existing code with the patched code. After saving the changes, the vulnerability should be mitigated. It is recommended to apply the official patch as soon as possible to ensure long-term security.
Conclusion
The org.xwiki.platform:xwiki-platform-flamingo-theme-ui package is vulnerable to an Eval Injection vulnerability that allows an attacker to execute arbitrary code in XWiki. This can lead to unauthorized access, data manipulation, and disruption of the XWiki platform. It is crucial to update the package to one of the patched versions (13.10.11, 14.4.7, or 14.10) or apply the provided workaround to mitigate the vulnerability. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the ongoing security of your XWiki installation.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui →
FAQ
The vulnerability allows an attacker with view rights on commonly accessible documents to execute arbitrary code in XWiki, potentially leading to full access to the XWiki installation. This can result in unauthorized access to sensitive information, modification of content, and disruption of the XWiki platform.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Simply enter the URL of your XWiki installation and the playground will provide information on any known vulnerabilities, including this Eval Injection vulnerability.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the patch or workaround as soon as possible to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can craft a specific URL and send it to a user with view rights on commonly accessible documents. When the user accesses the URL, the injected code will be executed in the context of the XWiki installation.
Yes, you can find more information about this vulnerability in the XWiki Jira issue XWIKI-20279 (https://jira.xwiki.org/browse/XWIKI-20279) and the corresponding GitHub commit (https://github.com/xwiki/xwiki-platform/commit/80d5be36f700adcd56b6c8eb3ed8b973f62ec0ae). These resources provide details on the vulnerability, its impact, and the patch that has been applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui.
