CVE-2023-30537: Privilege Escalation in org.xwiki.platform:xwiki-platform-flamingo-theme-ui
Summary
CVE-2023-30537: org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation. Affects org.xwiki.platform:xwiki-platform-flamingo-theme-ui across 3 version ranges.
>= 12.6.6, < 13.10.11
>= 14.0-rc-1, < 14.4.7
>= 14.5, < 14.10
Fixed in 13.10.11, 14.4.7 or 14.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.xwiki.platform:xwiki-platform-flamingo-theme-ui is a Maven package that provides the Flamingo theme UI for XWiki installations. It allows users to customize the appearance of their XWiki instance. However, a vulnerability has been discovered in this package that can lead to privilege escalation.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-flamingo-theme-ui allows any user with the right to add an object on a page to execute arbitrary Groovy, Python, or Velocity code in XWiki. This can result in full access to the XWiki installation. The issue stems from improper escaping of the styles properties in the 'FlamingoThemesCode.WebHome' page, which is installed by default. An attacker can exploit this vulnerability by adding a malicious object of type 'Theme Class' in their user profile, allowing them to execute arbitrary code and escalate their privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.6.6, < 13.10.1113.10.11 -
>= 14.0-rc-1, < 14.4.714.4.7 -
>= 14.5, < 14.1014.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to a patched version is not immediately possible, a temporary workaround can be applied. The issue can be fixed by manually applying the provided patch on the 'FlamingoThemesCode.WebHomeSheet' file. The patch can be found at the following URL: Patch. By applying this patch, the vulnerability can be mitigated until a proper update can be performed.
Conclusion
The vulnerability in org.xwiki.platform:xwiki-platform-flamingo-theme-ui allows for privilege escalation and the execution of arbitrary code in XWiki. It is crucial to update to the latest patched versions or apply the provided patch to mitigate this vulnerability. Prompt action is necessary to prevent potential unauthorized access and compromise of the XWiki installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui →
FAQ
The vulnerability allows an attacker to execute arbitrary code in XWiki, leading to full access to the XWiki installation. This can result in unauthorized access to sensitive data, modification of content, and potential further compromise of the system.
Any XWiki installation that is using a vulnerable version of the org.xwiki.platform:xwiki-platform-flamingo-theme-ui package is affected by this vulnerability. Users with the right to add objects on a page are particularly at risk.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to promptly update or apply the provided patch to prevent any potential exploitation.
No, this vulnerability requires an authenticated user with the right to add objects on a page. It cannot be exploited remotely without valid credentials.
Yes, the vulnerability has been patched in XWiki versions 13.10.11, 14.4.7, and 14.10. It is recommended to update to one of these versions to ensure the security of the XWiki installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-flamingo-theme-ui.
