XWiki Platform prior 14.10.10/15.4 RC1 authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in XWiki Platform. This impacts an unknown function. Such manipulation leads to authorization. This vulnerability is referenced as CVE-2023-41046. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in XWiki Platform (Content Management System). Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.

The weakness was published 09/02/2023 as GHSA-m5m2-h6h9-p2c8. The advisory is available at github.com. This vulnerability is handled as CVE-2023-41046 since 08/22/2023. The technical details are unknown and an exploit is not available.

Upgrading to version 14.10.10 or 15.4 RC1 eliminates this vulnerability. Applying the patch edc52579eeaab1b4514785c134044671a1ecd839 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• XWiki

Name

• Platform

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion