CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
15.5%
Parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user’s own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce, edit your user profile with the object editor and add a UIExtension object with the following values:
Extension Point ID: org.xwiki.platform.panels.Applications
Extension ID: platform.panels.myFakeApplication
Extension parameters:
label=I got programming right: $services.security.authorization.hasAccess('programming')
target=Main.WebHome
targetQueryString=
icon=icon:bomb
Extension Scope: "Current User".
Save the document and open any document. If an application entry with the text “I got programming right: true” is displayed, the attack succeeded, if the code in “label” is displayed literally, the XWiki installation isn’t vulnerable.
This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1.
We’re not aware of any workarounds apart from upgrading.
Vendor | Product | Version | CPE |
---|---|---|---|
org.xwiki.platform | xwiki-platform-uiextension-api | * | cpe:2.3:a:org.xwiki.platform:xwiki-platform-uiextension-api:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-c2gg-4gq4-jv5j
github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea
github.com/xwiki/xwiki-platform/commit/1b2574eb966457ca4ef34e557376b8751d1be90d
github.com/xwiki/xwiki-platform/commit/56748e154a9011f0d6239bec0823eaaeab6ec3f7
github.com/xwiki/xwiki-platform/security/advisories/GHSA-c2gg-4gq4-jv5j
jira.xwiki.org/browse/XWIKI-21335
nvd.nist.gov/vuln/detail/CVE-2024-31997