Critical · published March 2, 2023
🚨 An icon theme can become a backdoor! With XWiki Platform starting from version 6.2-milestone-1, an attacker can execute anything just by creating a crafty icon theme. 🔥 Think of it like a restaurant allowing customers to submit their own recipes as specials. If no one checks the ingredients, you could end up with something toxic on the menu! This vulnerability allows any user—even those without edit rights—to execute arbitrary content just by modifying the icon theme. This means a malicious user could potentially hijack functionality, steal sensitive information, or wreak havoc on the system!
Think of it like a restaurant allowing customers to submit their own recipes as specials. If no one checks the ingredients, you could end up with something toxic on the menu! The flaw lies in the 'IconThemeSheet' where users can craft an icon theme containing executable content, bypassing normal access controls and allowing execution of arbitrary code.
This vulnerability allows any user—even those without edit rights—to execute arbitrary content just by modifying the icon theme. This means a malicious user could potentially hijack functionality, steal sensitive information, or wreak havoc on the system! To patch the vulnerability, upgrade XWiki to version 14.9, 14.4.6, or 13.10.10. If an upgrade isn’t immediately possible, apply the workaround by modifying the page `IconThemesCode.IconThemeSheet` with the fix from commit 48caf7491595238af2b531026a614221d5d61f38. You’ve got this! With these quick fixes, you can lock down your XWiki and keep those pesky intruders at bay! 🛡️