CVE-2023-29516
📋 TL;DR
CVE-2023-29516 is a critical remote code execution vulnerability in XWiki Platform where any user with view rights on the XWiki.AttachmentSelector page can execute arbitrary Groovy, Python, or Velocity code. This leads to full compromise of the XWiki installation. The vulnerability affects all XWiki installations with the default configuration.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code, access sensitive data, modify content, and potentially pivot to other systems.
Likely Case
Unauthorized users gaining administrative privileges, data exfiltration, and complete control over the XWiki instance.
If Mitigated
If proper network segmentation and access controls exist, impact may be limited to the XWiki application and its data.
🎯 Exploit Status
Exploitation requires view rights on the vulnerable page, which is typically granted to authenticated users. The vulnerability is in improper escaping in the 'Cancel and return to page' button.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.10.11, 14.4.8, 14.10.1, or 15.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f
Restart Required: Yes
Instructions:
1. Identify your XWiki version. 2. Upgrade to a patched version: 13.10.11, 14.4.8, 14.10.1, or 15.0-rc-1. 3. Restart the XWiki service. 4. Verify the fix by checking the version and testing the vulnerable functionality.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Immediately restrict access to XWiki.AttachmentSelector page to only absolutely necessary administrative users
- Implement network-level controls to limit access to XWiki instances and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check your XWiki version. If it's older than 13.10.11, 14.4.8, 14.10.1, or 15.0-rc-1, you are vulnerable.Check Version:
Check XWiki administration panel or view the XWiki version in the web interface footer.Verify Fix Applied:
After patching, verify the version is 13.10.11, 14.4.8, 14.10.1, or 15.0-rc-1 or newer. Test the XWiki.AttachmentSelector functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Groovy/Python/Velocity code execution patterns
- Unauthorized access attempts to XWiki.AttachmentSelector
- Suspicious administrative actions from non-admin users
Network Indicators:
- Unusual outbound connections from XWiki server
- Traffic patterns indicating data exfiltration
SIEM Query:
Search for: 'XWiki.AttachmentSelector' access logs, unusual script execution events, or privilege escalation patterns in XWiki audit logs🔗 References
- https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f
- https://jira.xwiki.org/browse/XWIKI-20275
- https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f
- https://jira.xwiki.org/browse/XWIKI-20275
