XWiki Platform up to 14.10.8/15.3 Groovy Script access control

Summaryinfo

A vulnerability labeled as critical has been found in XWiki Platform up to 14.10.8/15.3. This impacts an unknown function of the component Groovy Script Handler. Such manipulation leads to access control. This vulnerability is traded as CVE-2023-40573. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in XWiki Platform up to 14.10.8/15.3 (Content Management System) and classified as critical. Affected by this issue is an unknown part of the component Groovy Script Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.

The weakness was shared 08/24/2023 as GHSA-8xhr-x3v8-rghj. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-40573 since 08/16/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 14.10.9 or 15.4RC1 eliminates this vulnerability. Applying the patch fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• XWiki

Name

• Platform

Version

• 14.10.0
• 14.10.1
• 14.10.2
• 14.10.3
• 14.10.4
• 14.10.5
• 14.10.6
• 14.10.7
• 14.10.8
• 15.0
• 15.1
• 15.2
• 15.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion