CVE-2023-41046: Velocity execution without script right in org.xwiki.platform:xwiki-platform-oldcore
Summary
CVE-2023-41046: Velocity execution without script right through VelocityCode and VelocityWiki property. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
>= 7.2, < 14.10.10
>= 15.0-rc-1, < 15.4-rc-1
Fixed in 14.10.10 or 15.4-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.xwiki.platform:xwiki-platform-oldcore is a Maven package that provides core functionality for the XWiki platform. XWiki is an open-source wiki software that allows users to create and collaborate on content. The package includes features such as document management, user authentication, and scripting capabilities using Velocity templates. However, a vulnerability has been discovered in the package that allows for the execution of Velocity code without the necessary script right.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-oldcore allows an attacker to execute Velocity code without having the script right. This can be achieved by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". When adding the property to an object, the Velocity code is executed regardless of the author's rights, although edit right is still required. The code is executed with the correct context author, preventing access to privileged APIs but still granting access to otherwise inaccessible data and APIs. This could potentially lead to further privilege escalation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.2, < 14.10.1014.10.10 -
>= 15.0-rc-1, < 15.4-rc-115.4-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The vulnerability in org.xwiki.platform:xwiki-platform-oldcore allows for the execution of Velocity code without the necessary script right. It has been patched in versions 14.10.10 and 15.4 RC1. To fix the vulnerability, it is recommended to update to one of these patched versions. If you require further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
org.xwiki.platform:xwiki-platform-oldcore is a Maven package that provides core functionality for the XWiki platform. XWiki is an open-source wiki software that allows users to create and collaborate on content.
The vulnerability occurs when creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". When adding the property to an object, the Velocity code is executed without the necessary script right.
The vulnerability allows for the execution of Velocity code without the necessary script right. While it does not grant access to privileged APIs, it can still provide access to otherwise inaccessible data and APIs, potentially leading to further privilege escalation.
Yes, the vulnerability has been patched in versions 14.10.10 and 15.4 RC1 of org.xwiki.platform:xwiki-platform-oldcore.
No, there are no known workarounds for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
