CVE-2021-21379
📋 TL;DR
This CVE allows privilege escalation in XWiki Platform where the {{wikimacrocontent}} executes content with wiki macro author rights instead of caller rights, enabling script injection with programming privileges. It affects XWiki installations with custom or extension-installed wiki macros. No default macros are vulnerable, but custom implementations could be exploited.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with programming rights leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Privilege escalation allowing authenticated users to execute arbitrary code with elevated permissions within the wiki context.
If Mitigated
Limited impact if no custom wiki macros exist and proper access controls restrict macro creation to trusted users.
🎯 Exploit Status
Requires authenticated access and knowledge of vulnerable wiki macros. No public exploit code available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XWiki 12.6.3, 11.10.11, or 12.8-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v662-xpcc-9xf6
Restart Required: Yes
Instructions:
1. Backup your XWiki instance. 2. Upgrade to XWiki 12.6.3, 11.10.11, or 12.8-rc-1. 3. Restart the XWiki service. 4. Verify the patch is applied by checking version.
🔧 Temporary Workarounds
Disable vulnerable wiki macros
allIdentify and disable any custom wiki macros that use {{wikimacrocontent}}
Review and remove custom wiki macros via XWiki administration interface
🧯 If You Can't Patch
- Restrict wiki macro creation to trusted administrators only
- Audit all custom wiki macros and extensions for {{wikimacrocontent}} usage
🔍 How to Verify
Check if Vulnerable:
Check XWiki version and review installed extensions/custom macros for {{wikimacrocontent}} usageCheck Version:
Check XWiki administration dashboard or view /xwiki/bin/view/Main/WebHome page source for version infoVerify Fix Applied:
Verify XWiki version is 12.6.3, 11.10.11, or 12.8-rc-1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual macro execution patterns
- Script execution from wiki macro content
Network Indicators:
- Unusual outbound connections from XWiki server
SIEM Query:
Search for 'wikimacrocontent' in XWiki application logs with suspicious payloads