CVE-2023-29510
📋 TL;DR
This vulnerability allows any user with edit access to at least one document (including their own profile by default) to inject malicious code through translation overrides, leading to remote code execution. It affects XWiki Platform installations where users can edit documents. The vulnerability stems from improper escaping of user-provided translations in privileged contexts.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the XWiki server, potentially leading to data theft, lateral movement, or deployment of ransomware.
Likely Case
Authenticated users exploiting the vulnerability to execute arbitrary code, potentially compromising sensitive data or disrupting services.
If Mitigated
With proper access controls and script rights restrictions, impact is limited to users with script privileges only.
🎯 Exploit Status
Exploitation requires authenticated user with edit access to at least one document. The vulnerability is well-documented in the advisory with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.10.2 or 15.0 RC1 and later
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw
Restart Required: Yes
Instructions:
1. Backup your XWiki installation and database. 2. Download XWiki 14.10.2 or 15.0 RC1 from official sources. 3. Stop the XWiki service. 4. Replace the installation with the patched version. 5. Restart the XWiki service. 6. Verify the version is updated.
🧯 If You Can't Patch
- Restrict script rights for all regular users globally in XWiki configuration.
- Disable user profile editing for all users through access controls.
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via Administration → About XWiki. If version is below 14.10.2 and not 15.0 RC1 or later, the system is vulnerable.Check Version:
Check the XWiki web interface at Administration → About XWiki or examine the xwiki.cfg file.Verify Fix Applied:
Verify version is 14.10.2 or 15.0 RC1 or later. Test that user-scoped translations now require script right by attempting to add a translation as a regular user.📡 Detection & Monitoring
Log Indicators:
- Unusual translation modification events
- Script execution from user translation contexts
- Error logs related to translation parsing
Network Indicators:
- Unusual outbound connections from XWiki server following user translation activities
SIEM Query:
source="xwiki.log" AND ("translation" OR "script") AND ("error" OR "execution" OR "malicious")🔗 References
- https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw
- https://jira.xwiki.org/browse/XWIKI-19749
- https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw
- https://jira.xwiki.org/browse/XWIKI-19749
