GHSA-j2pq-22jj-4pm5

Suggest an improvement
Source
https://github.com/advisories/GHSA-j2pq-22jj-4pm5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-j2pq-22jj-4pm5/GHSA-j2pq-22jj-4pm5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j2pq-22jj-4pm5
Aliases
  • CVE-2024-55662
Published
2024-12-12T19:23:04Z
Modified
2024-12-12T19:57:25.475442Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki allows remote code execution through the extension sheet
Details

Impact

On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type ExtensionCode.ExtensionClass. Set the description to {{async}}{{groovy}}println("Hello from Description"){{/groovy}}{{/async}} and press Save and View. If the description displays as Hello from Description without any error, then the instance is vulnerable.

Patches

This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0.

Workarounds

Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it. It is also possible to manually apply this patch to the page ExtensionCode.ExtensionSheet, as well as this patch to the page ExtensionCode.ExtensionAuthorsDisplayer.

References

  • https://jira.xwiki.org/browse/XWIKI-21890
  • https://github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific 
{
    "nvd_published_at": "2024-12-12T18:15:27Z",
    "cwe_ids": [
        "CWE-863",
        "CWE-96"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-12T19:23:04Z"
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-repository-server-ui

Package

Name
org.xwiki.platform:xwiki-platform-repository-server-ui
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-repository-server-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3-milestone-1
Fixed
15.10.9

Maven / org.xwiki.platform:xwiki-platform-repository-server-ui

Package

Name
org.xwiki.platform:xwiki-platform-repository-server-ui
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-repository-server-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.0.0-rc-1
Fixed
16.3.0