Critical, CVSS 9.9MavenPublished
XWiki allows remote code execution through the extension sheet
CVE-2024-55662 · GHSA-j2pq-22jj-4pm5
- Affected
- Maven org.xwiki.platform:xwiki-platform-repository-server-ui >= 3.3-milestone-1, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0
- Fixed in
- 15.10.916.3.0· Vendor fix available
- Issue
- Impact On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type ExtensionCode.ExtensionClass. Set the description to {{async}}{{groovy}}println("Hello from Description"){{/groovy}}{{/async}} and press Save and View. If the description displays as Hello from Description without any error, then the instance is vulnerable. Patches This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Workarounds Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it. It is also possible to manually apply this patch to the page ExtensionCode.ExtensionSheet, as well as this patch to the page ExtensionCode.ExtensionAuthorsDisplayer. References https://jira.xwiki.org/browse/XWIKI-21890…
Recommended action: Upgrade to 16.3.0 or 15.10.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.