CVE-2023-29518
📋 TL;DR
This vulnerability allows any user with view rights in XWiki Platform to execute arbitrary Groovy, Python, or Velocity code, leading to full compromise of the XWiki installation. The issue stems from improper escaping in the Invitation.InvitationCommon page, which is installed by default. All XWiki installations with vulnerable versions are affected.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise: attacker gains administrative access to XWiki, can execute arbitrary code on the server, access/modify all data, and potentially pivot to other systems.
Likely Case
Data breach and system takeover: attacker accesses sensitive wiki content, modifies pages, installs backdoors, and gains persistent access.
If Mitigated
Limited impact if proper network segmentation and least privilege access controls are implemented, though code execution would still be possible.
🎯 Exploit Status
Exploitation requires view rights but no authentication beyond that. The vulnerability is in a default component and code execution is straightforward once the flaw is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XWiki 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-px54-3w5j-qjg9
Restart Required: Yes
Instructions:
1. Backup your XWiki installation and database. 2. Download the patched version from xwiki.org. 3. Stop the XWiki service. 4. Replace the installation with the patched version. 5. Restart the XWiki service. 6. Verify the fix by checking the version.
🧯 If You Can't Patch
- Restrict access to only trusted users with view rights
- Implement network-level controls to limit access to XWiki from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via Admin → About or by examining the installation directory. If version is before 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11, you are vulnerable.Check Version:
Check the XWiki web interface at Admin → About or examine the xwiki-version.properties file in the installation directory.Verify Fix Applied:
After patching, verify the version shows one of the fixed versions: 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11.📡 Detection & Monitoring
Log Indicators:
- Unusual Groovy/Python/Velocity script execution in logs
- Access to Invitation.InvitationCommon page by non-admin users
- Unexpected administrative actions from non-admin accounts
Network Indicators:
- Unusual outbound connections from XWiki server
- Traffic patterns indicating code execution
SIEM Query:
source="xwiki.log" AND ("Groovy" OR "Python" OR "Velocity") AND "execution"🔗 References
- https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-px54-3w5j-qjg9
- https://jira.xwiki.org/browse/XWIKI-20283
- https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-px54-3w5j-qjg9
- https://jira.xwiki.org/browse/XWIKI-20283
