CVE-2024-37901
📋 TL;DR
This vulnerability allows any user with edit rights on any XWiki page to perform arbitrary remote code execution by adding specific objects to their user profile or other pages. This compromises the entire XWiki installation's confidentiality, integrity, and availability. All XWiki installations with users having edit permissions are affected.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise: attacker gains full control over the XWiki server, can execute arbitrary commands, access/modify all data, and potentially pivot to other systems.
Likely Case
Attacker with edit rights (common in collaborative wikis) executes malicious code to steal sensitive data, deface content, or install backdoors.
If Mitigated
Limited impact if edit rights are strictly controlled and only granted to highly trusted users, though risk remains for those users.
🎯 Exploit Status
Exploitation requires edit rights but is straightforward once those rights are obtained; weaponization is likely given the high impact and public advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.10.21, 15.5.5, or 15.10.2
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5
Restart Required: Yes
Instructions:
1. Identify your XWiki version. 2. Upgrade to 14.10.21, 15.5.5, or 15.10.2 depending on your branch. 3. Restart the XWiki application server.
🔧 Temporary Workarounds
Restrict Edit Permissions
allTemporarily remove edit rights from all non-administrative users to prevent exploitation.
Use XWiki administration interface to modify global or space permissions, removing edit rights for users/groups.
🧯 If You Can't Patch
- Immediately audit and restrict all user edit permissions to only absolutely necessary trusted administrators.
- Monitor logs for suspicious activity related to XWiki.SearchSuggestConfig or XWiki.SearchSuggestSourceClass object creation.
🔍 How to Verify
Check if Vulnerable:
Check XWiki version via administration panel; if below 14.10.21, 15.5.5, or 15.10.2, you are vulnerable.Check Version:
In XWiki, navigate to Administration > About or check the XWiki WAR file version.Verify Fix Applied:
After patching, confirm version is 14.10.21, 15.5.5, or 15.10.2 or higher via administration panel.📡 Detection & Monitoring
Log Indicators:
- Log entries showing creation or modification of XWiki.SearchSuggestConfig or XWiki.SearchSuggestSourceClass objects by non-admin users.
Network Indicators:
- Unusual outbound connections from XWiki server post-edit actions.
SIEM Query:
source="xwiki.log" AND ("XWiki.SearchSuggestConfig" OR "XWiki.SearchSuggestSourceClass") AND user!="admin"🔗 References
- https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b
- https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e
- https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4
- https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5
- https://jira.xwiki.org/browse/XWIKI-21473
