CVE-2023-40573: Remote Code Execution in XWiki Platform's Groovy Jobs
Summary
CVE-2023-40573: XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution. Affects org.xwiki.platform:xwiki-platform-scheduler-api across 2 version ranges.
< 14.10.9
>= 15.0-rc-1, < 15.4-rc-1
Fixed in 14.10.9 or 15.4-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It supports scheduled jobs that can execute Groovy scripts. These jobs are used for various tasks such as automation and data processing. However, a vulnerability in the platform's Groovy jobs allows an attacker to execute arbitrary code remotely.
Vulnerability Detail
The vulnerability arises from the incorrect checking of the content author of a job script. When a job script is modified or added to a document, the content author is not updated. This can be exploited by an attacker with edit rights on the wiki, in combination with a CSRF vulnerability in the job scheduler. By creating a malicious job script and triggering or scheduling the job, the attacker can execute arbitrary code on the target system. The impact of this vulnerability can be severe, as it allows unauthorized code execution and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 14.10.914.10.9 -
>= 15.0-rc-1, < 15.4-rc-115.4-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patches mentioned above to mitigate the risk of remote code execution.
Conclusion
The vulnerability in XWiki Platform's Groovy jobs poses a significant risk of remote code execution. It is crucial to update the software to the patched versions mentioned above to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-scheduler-api →
FAQ
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It provides various features for managing and organizing information.
Groovy jobs in XWiki are scheduled tasks that execute Groovy scripts. These jobs can be used for automation, data processing, and other custom tasks.
The vulnerability occurs due to incorrect checking of the content author of a job script. When a job script is modified or added to a document, the content author is not updated. This allows an attacker to create a malicious job script and execute arbitrary code remotely.
The vulnerability allows an attacker with edit rights on the wiki to execute arbitrary code remotely. This can lead to unauthorized access, data compromise, and potential control over the entire system.
To mitigate the risk, it is crucial to update XWiki to version 14.10.9 or 15.4RC1, which include the necessary patches. These patches fix the incorrect checking of the content author and ensure proper verification before executing job scripts.
