CVE-2024-31996: XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
Summary
CVE-2024-31996: XWiki Commons missing escaping of { in Velocity escapetool allows remote code execution. Affects org.xwiki.commons:xwiki-commons-velocity across 3 version ranges.
>= 3.0.1, < 14.10.19
>= 15.0-rc-1, < 15.5.4
>= 15.6-rc-1, < 15.9-rc-1
Fixed in 14.10.19, 15.5.4 or 15.9-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Commons is a library used in XWiki, an open-source platform for developing collaborative applications. It provides various utilities and tools for handling common tasks in XWiki. One of these tools is the Velocity escapetool, which is responsible for HTML escaping. However, a vulnerability in the escapetool allows for remote code execution due to the lack of proper escaping of the { character. This vulnerability can be exploited to inject XWiki syntax and execute arbitrary code.
Vulnerability Detail
The vulnerability arises from the inadequate HTML escaping of the Velocity escapetool in XWiki Commons. By exploiting this issue, an attacker can inject malicious XWiki syntax containing arbitrary code. This can lead to remote code execution and potentially compromise the entire XWiki installation. An example of a vulnerable URL parameter that triggers the vulnerability is Panels/PanelLayoutUpdate?place=%7B%7B%2Fhtml%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bvelocity%7D%7D%23evaluate(%24request.eval)%7B%7B%2Fvelocity%7D%7D%7B%7B%2Fasync%7D%7D&eval=Hello%20from%20URL%20Parameter!%20I%20got%20programming%3A%20%24services.security.authorization.hasAccess(%27programming%27).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.1, < 14.10.1914.10.19 -
>= 15.0-rc-1, < 15.5.415.5.4 -
>= 15.6-rc-1, < 15.9-rc-115.9-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To apply the workaround, locate the Panels.PanelLayoutUpdate document in your XWiki installation and replace instances of $escapetool.html with $escapetool.xml. This will ensure that the proper escaping is applied and mitigate the vulnerability. It is important to note that this workaround is specific to the mentioned document and may not be applicable to other extensions.
Conclusion
The XWiki Commons library in XWiki is vulnerable to remote code execution due to a lack of proper escaping in the Velocity escapetool. This can be exploited by injecting malicious XWiki syntax. It is crucial to upgrade to the patched versions or apply the provided workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.commons:xwiki-commons-velocity →
FAQ
XWiki Commons is a library used in XWiki that provides utilities and tools for common tasks in XWiki development.
The Velocity escapetool is a tool in XWiki Commons responsible for HTML escaping.
The vulnerability arises from the lack of proper escaping of the { character in the Velocity escapetool. This allows an attacker to inject malicious XWiki syntax containing arbitrary code, which can be executed remotely.
To fix the vulnerability, upgrade your XWiki installation to version 14.10.19, 15.5.5, or 15.9 RC1. Alternatively, apply the specific workaround mentioned in the vulnerability details.
While the specific vulnerability is known to affect the Panels.PanelLayoutUpdate document, other extensions could potentially be affected as well. It is recommended to review and patch any extensions that expose this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.commons:xwiki-commons-velocity.
