Critical · published November 23, 2022
🚨 A user with view rights can execute any Groovy or Python code through the icon picker macro, turning them into a mini-hacker with just a few clicks! 🔥 Think of it like a restaurant where anyone can cook their favorite dish in the kitchen without a chef around — it sounds fun, but what if they add something dangerous to the mix? This vulnerability could allow an attacker to run arbitrary code, potentially compromising sensitive data or altering the system's behavior. Imagine a rogue chef who not only alters the menu but also poisons the entire kitchen! The consequences could be absolutely devastating if left unchecked.
Think of it like a restaurant where anyone can cook their favorite dish in the kitchen without a chef around — it sounds fun, but what if they add something dangerous to the mix? The issue lies in improper neutralization of the macro parameters of the icon picker macro, allowing untrusted code execution via evaluated directives, which can be exploited by any user with view rights on accessible documents.
This vulnerability could allow an attacker to run arbitrary code, potentially compromising sensitive data or altering the system's behavior. Imagine a rogue chef who not only alters the menu but also poisons the entire kitchen! The consequences could be absolutely devastating if left unchecked. To secure your XWiki installation, immediately upgrade to versions 13.10.7, 14.5, or 14.4.2. If upgrading isn’t possible right now, you can manually patch the vulnerability by editing `IconThemesCode.IconPickerMacro` in the object editor or by replacing the document with the updated version from the XAR archive containing only security fixes. You've got this! Follow these steps and you'll have your XWiki locked down in no time! 🛡️