CVE-2023-36470
📋 TL;DR
CVE-2023-36470 is a critical remote code execution vulnerability in XWiki Platform that allows attackers to inject and execute malicious code with programming rights through icon set manipulation. This affects all XWiki instances running vulnerable versions, enabling complete compromise of the wiki instance. Attackers can exploit this via the icon picker or by editing icon themes to execute arbitrary code.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the XWiki instance allowing attackers to execute arbitrary code, access/modify all data, install backdoors, and potentially pivot to other systems.
Likely Case
Remote code execution leading to data theft, privilege escalation, and installation of persistent backdoors or malware.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation, though internal threats remain.
🎯 Exploit Status
Multiple attack vectors exist including via icon picker and icon theme editing. The advisory provides technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.10.6 or 15.1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf
Restart Required: Yes
Instructions:
1. Backup your XWiki instance. 2. Upgrade to XWiki 14.10.6 or 15.1. 3. Restart the XWiki service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Isolate the XWiki instance from the internet and restrict internal access to only necessary users
- Implement strict monitoring and alerting for suspicious activity on the XWiki server
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via Admin interface or by examining the installation directory. Versions before 14.10.6 or 15.1 are vulnerable.Check Version:
Check XWiki admin dashboard or examine the XWiki installation files for version information.Verify Fix Applied:
Verify the version is 14.10.6 or higher (14.x branch) or 15.1 or higher (15.x branch). Test icon functionality to ensure it works without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual icon theme modifications
- Velocity code execution in icon-related requests
- Suspicious script macro injections
Network Indicators:
- HTTP requests to icon picker endpoints with malicious payloads
- Unusual outbound connections from XWiki server
SIEM Query:
Search for POST requests to */rest/wikis/*/icon* endpoints with suspicious content or Velocity code patterns🔗 References
- https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94
- https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4
- https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf
- https://jira.xwiki.org/browse/XWIKI-20524
- https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94
- https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4
- https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf
- https://jira.xwiki.org/browse/XWIKI-20524
