CVE-2023-45144 – This vulnerability in XWiki's Identity OAuth UI... (How to Fix)

Q: What is the severity of CVE-2023-45144?

CVE-2023-45144 has a CVSS score of 10.0 (CRITICAL). This vulnerability in XWiki's Identity OAuth UI component allows attackers to inject malicious scripts and XWiki syntax via OAuth login parameters. Successful exploitation enables remote code execution through Groovy macros, compromising the entire XWiki installation. All XWiki instances using vulnerable versions of the identity-oauth-ui package are affected.

📋 TL;DR

This vulnerability in XWiki's Identity OAuth UI component allows attackers to inject malicious scripts and XWiki syntax via OAuth login parameters. Successful exploitation enables remote code execution through Groovy macros, compromising the entire XWiki installation. All XWiki instances using vulnerable versions of the identity-oauth-ui package are affected.

💻 Affected Systems

Products:

XWiki with Identity OAuth UI component

Versions: All versions before 1.6

Operating Systems: All operating systems running XWiki

Default Config Vulnerable: ⚠️ Yes

Notes: Affects any XWiki installation using the vulnerable identity-oauth-ui package for OAuth authentication.

📦 What is this software?

Oauth Identity by Xwiki

View all CVEs affecting Oauth Identity →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of XWiki installation with administrative access, data theft, system takeover, and potential lateral movement to connected systems.

🟠

Likely Case

Unauthenticated remote code execution leading to data exfiltration, privilege escalation, and installation of backdoors or malware.

🟢

If Mitigated

Limited impact if proper input validation and output encoding are implemented, though risk remains due to the nature of the vulnerability.

🌐 Internet-Facing: HIGH - Exploitable via OAuth login flows which are typically internet-facing, allowing unauthenticated attackers to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Still exploitable by internal attackers or compromised accounts, but attack surface is reduced compared to internet-facing deployments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is in the login flow and requires no authentication. Exploitation involves crafting malicious OAuth parameters with XSS and Groovy macro injection.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.6

Vendor Advisory: https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh

Restart Required: Yes

Instructions:

1. Identify XWiki installation version and identity-oauth-ui package version. 2. Update identity-oauth-ui to version 1.6 or later via XWiki Extension Manager or manual installation. 3. Restart XWiki application server. 4. Verify the fix by checking the package version.

🔧 Temporary Workarounds

No known workarounds

all

The vendor advisory states there are no known workarounds for this vulnerability.

🧯 If You Can't Patch

Disable OAuth authentication method entirely if not required
Implement strict network access controls to limit exposure to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check the identity-oauth-ui package version in XWiki Administration > Extensions. If version is below 1.6, the system is vulnerable.

Check Version:

Check XWiki Administration panel or examine WEB-INF/lib/identity-oauth-ui-*.jar file version

Verify Fix Applied:

Verify identity-oauth-ui package version is 1.6 or higher in XWiki Administration > Extensions.

📡 Detection & Monitoring

Log Indicators:

Unusual OAuth login attempts with long or encoded parameters
Groovy macro execution from unexpected sources
Error logs containing script injection attempts

Network Indicators:

HTTP GET requests to OAuth endpoints with suspicious parameter values
Requests containing script tags or Groovy macro syntax

SIEM Query:

web_access_logs WHERE (url_path CONTAINS '/oauth/' OR url_path CONTAINS '/login/') AND (query_string CONTAINS '<script' OR query_string CONTAINS '{{groovy' OR query_string CONTAINS '%3Cscript')

📊 Metadata

CVE ID: CVE-2023-45144

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-79

Published: October 16, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-45144, you might also want to check these: