CVE-2021-21380
📋 TL;DR
This vulnerability allows SQL injection in XWiki Platform's Ratings API for users with Script rights. Attackers can execute arbitrary SQL queries, potentially accessing, modifying, or deleting database content. Only affects XWiki installations with the Ratings API installed.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, deletion, or potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation by users with Script rights.
If Mitigated
Limited impact if proper access controls restrict Script rights and database permissions are minimized.
🎯 Exploit Status
Exploitation requires Script rights. SQL injection is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XWiki 12.9RC1 and later
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5
Restart Required: Yes
Instructions:
1. Upgrade XWiki Platform to version 12.9RC1 or later. 2. Restart the XWiki service. 3. Verify the Ratings API is properly updated.
🔧 Temporary Workarounds
Uninstall Ratings API
allRemove the vulnerable Ratings API extension from XWiki
Navigate to XWiki Extension Manager and uninstall Ratings API
🧯 If You Can't Patch
- Restrict Script rights to only essential, trusted users
- Implement network segmentation and firewall rules to limit access to XWiki instances
🔍 How to Verify
Check if Vulnerable:
Check if Ratings API is installed and XWiki version is below 12.9RC1Check Version:
Check XWiki administration panel or xwiki.cfg file for version informationVerify Fix Applied:
Verify XWiki version is 12.9RC1 or later and check that SQL injection attempts are properly escaped📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by script execution
Network Indicators:
- Unusual database connection patterns from XWiki server
SIEM Query:
source="xwiki.log" AND ("SQL" OR "database" OR "query") AND ("error" OR "exception" OR "injection")