by Kastro
Paper/Archive/CVE-2024-31986

CVE-2024-31986

xwiki xwiki-platform — XWiki Platform CSRF remote code execution through scheduler job's document reference

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an `XWiki.SchedulerJobClass` XObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, apply the patch manually by modifying the `Scheduler.WebHome` page.

Affected

ProductAffectedFixed inSource
xwiki-platform>= 3.1, < 14.10.19–CNA
xwiki-platform>= 15.0-rc-1, < 15.5.4–CNA
xwiki-platform>= 15.6-rc-1, < 15.9–CNA
xwiki3.1 – < 14.10.1914.10.19CISA-ADP
xwiki15.0 – < 15.5.415.5.4CISA-ADP
xwiki15.6 – < 15.915.9CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-37m4-hqxv-w26grefgithub.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cfrefgithub.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87refgithub.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269refjira.xwiki.org/browse/XWIKI-21416