CVE-2023-35166
📋 TL;DR
This vulnerability in XWiki Platform allows attackers to execute arbitrary wiki content with the privileges of the TipsPanel author by creating a malicious tip UI extension. This affects all XWiki installations running vulnerable versions, potentially enabling privilege escalation and remote code execution.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, data theft, and lateral movement within the environment.
Likely Case
Privilege escalation leading to unauthorized access to sensitive wiki content and administrative functions.
If Mitigated
Limited impact if proper access controls and network segmentation are implemented.
🎯 Exploit Status
Exploitation requires creating a tip UI extension, which typically requires some level of access to the wiki.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XWiki 14.10.5 or 15.1-rc-1 and later
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h
Restart Required: Yes
Instructions:
1. Backup your XWiki installation. 2. Upgrade to XWiki 14.10.5 or 15.1-rc-1 or later. 3. Restart the XWiki service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable TipsPanel Extension
allRemove or disable the TipsPanel UI extension functionality to prevent exploitation.
Edit XWiki configuration to disable TipsPanel extensions
🧯 If You Can't Patch
- Restrict access to wiki editing functions to trusted users only
- Implement network segmentation to isolate XWiki instances from critical systems
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via admin interface or by examining installation files.Check Version:
Check XWiki version in admin dashboard or via system information page.Verify Fix Applied:
Verify XWiki version is 14.10.5 or 15.1-rc-1 or later after upgrade.📡 Detection & Monitoring
Log Indicators:
- Unusual creation of tip UI extensions
- Suspicious activity from non-admin users creating extensions
Network Indicators:
- Unusual API calls to extension creation endpoints
SIEM Query:
Search for events related to 'tip' or 'UI extension' creation by non-privileged users.🔗 References
- https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h
- https://jira.xwiki.org/browse/XWIKI-20281
- https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h
- https://jira.xwiki.org/browse/XWIKI-20281
