Critical · published March 2, 2023
🚨 A crafty bug lets any user with comment rights execute superadmin commands! This vulnerability in XWiki could turn a harmless discussion into a security nightmare! 🔥 Think of it as a café where customers have access to the kitchen — anyone could sneak in and use the chef's secret recipes without permission! In XWiki, the async macro operates outside the safety net, potentially allowing unauthorized actions. An attacker can exploit this flaw to execute any wiki content with full superadmin rights, leading to devastating consequences like unauthorized data access or even complete site takeover. This isn't just a minor oversight; it opens the door to total chaos in your wiki!
Think of it as a café where customers have access to the kitchen — anyone could sneak in and use the chef's secret recipes without permission! In XWiki, the async macro operates outside the safety net, potentially allowing unauthorized actions. Starting from version 11.6-rc-1, the async macro in XWiki fails to respect restricted modes meant to limit execution rights, allowing users with comment rights a dangerous level of control.
An attacker can exploit this flaw to execute any wiki content with full superadmin rights, leading to devastating consequences like unauthorized data access or even complete site takeover. This isn't just a minor oversight; it opens the door to total chaos in your wiki! Immediately update XWiki to version 14.9, 14.4.6, or 13.10.10 to patch this vulnerability. If an upgrade isn't feasible yet, apply the necessary patch for `org.xwiki.platform:xwiki-platform-rendering-async-macro` and rebuild the deployment. Don't wait! You've got this! With these steps, you'll strengthen your XWiki against this critical threat! 🛡️