XWiki Platform up to 14.10.7/15.1 REST API cross-site request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in XWiki Platform up to 14.10.7/15.1. Affected is an unknown function of the component REST API. Executing a manipulation can lead to cross-site request forgery. This vulnerability is tracked as CVE-2023-37277. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in XWiki Platform up to 14.10.7/15.1 (Content Management System). This vulnerability affects some unknown functionality of the component REST API. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation. For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.

The weakness was disclosed 07/10/2023 as GHSA-6xxr-648m-gch6. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-37277 since 06/29/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 14.10.8 or 15.2 eliminates this vulnerability. Applying the patch 4c175405faa0e62437df397811c7526dfc0fbae7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• XWiki

Name

• Platform

Version

• 14.10.0
• 14.10.1
• 14.10.2
• 14.10.3
• 14.10.4
• 14.10.5
• 14.10.6
• 14.10.7
• 15.0
• 15.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion