CVE-2023-37910
📋 TL;DR
This vulnerability in XWiki Platform allows attackers with edit access to any document (including default-editable user profiles) to move any attachment from any other document to their controlled document. This enables unauthorized access to sensitive attachments regardless of permissions and deletes them from the original source. All XWiki instances running affected versions are vulnerable.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of all sensitive attachments across the wiki, including confidential documents, credentials, or proprietary data, followed by their deletion from legitimate locations.
Likely Case
Targeted theft of specific known attachments containing sensitive information, potentially leading to data breaches or intellectual property theft.
If Mitigated
Limited impact if strict access controls are already in place, but still allows unauthorized movement of attachments between documents where the attacker has some edit rights.
🎯 Exploit Status
Requires authenticated user with edit rights on any document. Attack is straightforward once the attacker knows attachment names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.4.8, 14.10.4, or 15.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29
Restart Required: Yes
Instructions:
1. Backup your XWiki instance. 2. Download and install XWiki 14.4.8, 14.10.4, or 15.0-rc-1 from xwiki.org. 3. Follow XWiki upgrade documentation for your specific deployment method. 4. Restart the application server.
🔧 Temporary Workarounds
No official workaround
allThe vendor states there is no workaround apart from upgrading to a fixed version.
🧯 If You Can't Patch
- Restrict edit permissions on all documents, especially user profiles, to only trusted users
- Implement monitoring for unusual attachment movement patterns and audit attachment access logs
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via Admin interface or by examining the application files. If version is between 14.0-rc-1 and 14.4.7, or 14.10.0-14.10.3, or any 15.0 pre-release before 15.0-rc-1, you are vulnerable.Check Version:
Check XWiki Admin dashboard or examine WEB-INF/xwiki.properties file for version informationVerify Fix Applied:
After upgrade, verify version shows 14.4.8, 14.10.4, or 15.0-rc-1 or higher in Admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual attachment move operations between documents
- Attachment access from unexpected user accounts
- Multiple failed attachment access attempts followed by successful moves
Network Indicators:
- HTTP POST requests to attachment move endpoints from unauthorized users
SIEM Query:
source="xwiki.log" AND ("move attachment" OR "attachment moved") AND NOT user IN ["authorized_users_list"]🔗 References
- https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29
- https://jira.xwiki.org/browse/XWIKI-20334
- https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29
- https://jira.xwiki.org/browse/XWIKI-20334
