CVE-2023-29522
📋 TL;DR
CVE-2023-29522 is a critical remote code execution vulnerability in XWiki Platform that allows any user with view rights to execute arbitrary script macros (including Groovy and Python) by crafting malicious page names. This gives attackers unrestricted read/write access to all wiki content and full server compromise capabilities. All XWiki instances with vulnerable versions are affected.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized data access/modification, privilege escalation to admin, and installation of web shells for persistent access.
If Mitigated
Limited to authenticated users only, but still allows full wiki compromise and potential server access.
🎯 Exploit Status
Exploit requires only view rights (not edit/admin), making it highly accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.4.8, 14.10.3, or 15.0RC1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mjw9-3f9f-jq2w
Restart Required: Yes
Instructions:
1. Backup your XWiki instance. 2. Download patched version from xwiki.org. 3. Stop XWiki service. 4. Replace with patched version. 5. Restart XWiki service. 6. Verify version update.
🔧 Temporary Workarounds
No known workarounds
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Immediately restrict access to only trusted users and monitor for suspicious activity
- Implement network segmentation and isolate the XWiki instance from critical systems
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via admin interface or by examining installation filesCheck Version:
Check XWiki admin dashboard or examine WEB-INF/xwiki.properties fileVerify Fix Applied:
Verify version is 14.4.8, 14.10.3, or 15.0RC1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual page creation attempts with special characters
- Failed page access attempts with crafted names
- Execution of script macros from unexpected sources
Network Indicators:
- Unusual outbound connections from XWiki server
- Large data transfers from wiki database
SIEM Query:
source="xwiki.log" AND ("Page not found" OR "script macro" OR "Groovy" OR "Python") AND (special characters in request)🔗 References
- https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mjw9-3f9f-jq2w
- https://jira.xwiki.org/browse/XWIKI-20456
- https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mjw9-3f9f-jq2w
- https://jira.xwiki.org/browse/XWIKI-20456
