CVE-2023-40177: XWiki Platform privilege escalation in org.xwiki.platform:xwiki-platform-appwithinminutes-ui
Summary
CVE-2023-40177: XWiki Platform privilege escalation (PR) from account through AWM content fields. Affects org.xwiki.platform:xwiki-platform-appwithinminutes-ui versions >= 4.3-milestone-2, < 14.10.5. Fixed in 14.10.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-appwithinminutes-ui package is a component of the XWiki Platform, an open-source wiki software written in Java. It provides functionality for creating applications within minutes (AWM) by allowing users to define custom content fields. These fields can be used on various wiki pages, including user profile pages. However, a vulnerability in the package allows registered users to execute arbitrary scripts with programming rights, leading to privilege escalation.
Vulnerability Detail
The vulnerability arises from the AppWithinMinutes Application's support for the Content field, which executes the content with the rights of the AppWithinMinutes.Content author instead of the content author. This allows any registered user to exploit the content field of their user profile page to execute arbitrary scripts with programming rights, effectively escalating their privileges. The vulnerability has been present since version 4.3M2 of the XWiki Platform. The impact of this vulnerability is significant as it enables unauthorized users to gain elevated privileges within the system.
How To Fix
Minimum fixed version
14.10.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are using an older version of XWiki that has not been patched, you can apply a workaround by modifying the content of the AppWithinMinutes.Content page as described in the 'how_to_fix' section.
Conclusion
The privilege escalation vulnerability in the org.xwiki.platform:xwiki-platform-appwithinminutes-ui package of the XWiki Platform allows registered users to execute arbitrary scripts with programming rights, leading to unauthorized privilege escalation. It is crucial to upgrade to the patched versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-appwithinminutes-ui →
FAQ
The vulnerability allows any registered user to execute arbitrary scripts with programming rights, leading to privilege escalation within the XWiki Platform.
The vulnerability has been present since version 4.3M2 of the XWiki Platform. It has been fixed in versions 14.10.5 and 15.1RC1.
To fix this vulnerability, you should upgrade your XWiki installation to version 14.10.5 or 15.1RC1. Alternatively, you can apply the workaround mentioned in the 'workaround' section.
There are no known exploits for this vulnerability at the moment. However, it is recommended to apply the necessary patches or workarounds to mitigate the risk.
This vulnerability was discovered and reported by @michitux.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-appwithinminutes-ui.
