CVE-2023-50732
📋 TL;DR
This vulnerability in XWiki Platform allows attackers to execute Velocity scripts without proper script rights through the document tree. This affects all XWiki installations running vulnerable versions, potentially enabling unauthorized code execution.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized script execution allowing privilege escalation, data manipulation, or denial of service.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires some knowledge of XWiki's Velocity scripting and document tree structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.10.7 or 15.2RC1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj
Restart Required: Yes
Instructions:
1. Backup your XWiki installation. 2. Upgrade to XWiki 14.10.7 or 15.2RC1. 3. Restart the XWiki service. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict Document Tree Access
allLimit access to document tree functionality to trusted users only.
Configure XWiki rights to restrict 'view' and 'edit' rights on document tree features
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the XWiki instance.
- Disable or restrict Velocity scripting capabilities for non-administrative users.
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via admin interface or by examining the installation directory.Check Version:
Check XWiki admin dashboard or examine xwiki.properties file for version information.Verify Fix Applied:
Confirm version is 14.10.7 or 15.2RC1 or later, and test that Velocity scripts cannot be executed without proper rights.📡 Detection & Monitoring
Log Indicators:
- Unusual Velocity script execution attempts
- Failed authentication attempts followed by script execution
Network Indicators:
- Unexpected requests to document tree endpoints with script parameters
SIEM Query:
source="xwiki" AND (event="script_execution" OR event="velocity_execution") AND user!="admin"🔗 References
- https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj
- https://jira.xwiki.org/browse/XWIKI-20625
- https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj
- https://jira.xwiki.org/browse/XWIKI-20625
