← back
CVE-2023-29525

Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

CVSS 10 CRITICALEPSS 77.8%CWE-74
In short

A flaw in XWiki's notification administration page allows attackers with basic viewing permissions to inject malicious code through a URL parameter, gaining full programming rights and control over the system.

Technical detail

The vulnerability is an XWiki syntax injection in the 'since' parameter of the LegacyNotificationAdministration endpoint (CWE-74). An authenticated user with view rights can inject arbitrary XWiki syntax to escalate privileges to programming level, enabling arbitrary code execution on the server.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-platform

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-58cjhttps://jira.xwiki.org/browse/XWIKI-20287