CVE-2023-37462
📋 TL;DR
This vulnerability in XWiki Platform allows attackers with view rights on the SkinsCode.XWikiSkinsSheet document to escalate privileges to programming rights, enabling execution of arbitrary script macros including Groovy and Python. This leads to remote code execution with unrestricted read/write access to all wiki contents. All XWiki installations using vulnerable versions are affected.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the XWiki instance with full administrative control, data theft, data destruction, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive wiki content, data exfiltration, and installation of backdoors or malicious scripts.
If Mitigated
Limited impact if proper network segmentation, strict access controls, and monitoring are in place, though RCE would still be possible.
🎯 Exploit Status
Exploitation requires view rights on the vulnerable document. The advisory includes testing instructions indicating exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.4.8, 14.10.4, or 15.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg
Restart Required: Yes
Instructions:
1. Upgrade to XWiki 14.4.8, 14.10.4, or 15.0-rc-1. 2. Alternatively, manually apply commit d9c88ddc to the SkinsCode.XWikiSkinsSheet document. 3. Restart the XWiki service.
🔧 Temporary Workarounds
Manual patch application
allApply the fix commit directly to the vulnerable document without full upgrade
Apply changes from commit d9c88ddc4c0c78fa534bd33237e95dea66003d29 to SkinsCode.XWikiSkinsSheet
Restrict document access
allRemove view rights from SkinsCode.XWikiSkinsSheet for all non-admin users
Edit document rights to restrict SkinsCode.XWikiSkinsSheet to administrators only
🧯 If You Can't Patch
- Immediately restrict view access to SkinsCode.XWikiSkinsSheet document to administrators only
- Implement network segmentation to isolate XWiki instance and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Follow testing instructions in GHSA advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjgCheck Version:
Check XWiki version in administration panel or via xwiki.cfg configuration fileVerify Fix Applied:
Check that SkinsCode.XWikiSkinsSheet document contains the fix from commit d9c88ddc and test the exploit vector📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to SkinsCode.XWikiSkinsSheet
- Execution of Groovy/Python macros from non-admin users
- Creation of suspicious pages with crafted names
Network Indicators:
- Unexpected outbound connections from XWiki server
- Unusual API calls to document editing functions
SIEM Query:
source="xwiki" AND (document="SkinsCode.XWikiSkinsSheet" OR macro="groovy" OR macro="python") AND user!="admin"🔗 References
- https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg
- https://jira.xwiki.org/browse/XWIKI-20457
- https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg
- https://jira.xwiki.org/browse/XWIKI-20457
