CVE-2023-29527: XWiki Platform AppWithinMinutes-UI Code Injection Vulnerability
Summary
CVE-2023-29527: XWiki Platform vulnerable to code injection from account through AWM view sheet. Affects org.xwiki.platform:xwiki-platform-appwithinminutes-ui versions >= 7.4.4, < 14.10.3. Fixed in 14.10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. The AppWithinMinutes-UI package is a component of XWiki Platform that provides a user interface for creating applications within the wiki. This package is vulnerable to a code injection vulnerability that allows an attacker to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability arises from a lack of input validation in the handling of user-provided content. An attacker with a user account can inject malicious code into their user profile or any other document using the wiki editor. When viewing a document that contains an object of type AppWithinMinutes.LiveTableClass, the injected code is executed on the server, leading to potential remote code execution. This vulnerability has a CVSS score of 9.9, indicating its critical severity.
How To Fix
Minimum fixed version
14.10.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the provided patches or update to a patched version of XWiki Platform to mitigate the risk of code injection.
Conclusion
The XWiki Platform AppWithinMinutes-UI package is vulnerable to a code injection vulnerability that allows an attacker to execute arbitrary code on the server. To mitigate this risk, it is essential to update XWiki Platform to the patched versions or apply the provided patches. Regularly updating software and following secure coding practices are crucial for maintaining a secure environment. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-appwithinminutes-ui →
FAQ
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It provides a range of features for organizing and managing information within a wiki environment.
The AppWithinMinutes-UI package is a component of XWiki Platform that provides a user interface for creating applications within the wiki. It simplifies the process of building custom applications using predefined templates and configurations.
The vulnerability occurs due to a lack of input validation in the handling of user-provided content. An attacker with a user account can inject malicious code into their user profile or any other document using the wiki editor. When viewing a document that contains an object of type AppWithinMinutes.LiveTableClass, the injected code is executed on the server.
The code injection vulnerability allows an attacker to execute arbitrary code on the server. This can lead to various consequences, including unauthorized access, data theft, server compromise, and further exploitation of the affected system.
To mitigate the risk, it is crucial to update XWiki Platform to version 15.0-rc-1 or 14.10.3. These versions include patches that address the code injection vulnerability. Additionally, it is recommended to follow secure coding practices and regularly update software components to minimize the risk of similar vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-appwithinminutes-ui.
