Critical · published March 7, 2023
🚨 Any user with view rights can execute arbitrary code in XWiki — like handing over a master key to a room full of secrets! 🔥 It's as if a hotel allows any guest to access the staff-only areas with a simple passphrase — a recipe for chaos! An attacker could run any Groovy, Python, or Velocity code, compromising your entire XWiki installation. This means they could view, modify or delete your documents, potentially causing absolutely devastating data loss or unauthorized access. Your wiki could become a playground for malicious activity!
It's as if a hotel allows any guest to access the staff-only areas with a simple passphrase — a recipe for chaos! The vulnerability arises from improper escaping of UIX parameters, allowing any user with view rights to input and execute potentially harmful scripts. This change in input validation leads to remote code execution in the affected versions of XWiki Platform.
An attacker could run any Groovy, Python, or Velocity code, compromising your entire XWiki installation. This means they could view, modify or delete your documents, potentially causing absolutely devastating data loss or unauthorized access. Your wiki could become a playground for malicious activity! Upgrade to XWiki version 13.10.11, 14.4.7, or 14.10-rc-1 immediately to patch this vulnerability. If updating isn’t feasible, you can manually fix the issue by editing the `PanelsCode.ApplicationsPanelConfigurationSheet` wiki page with the modifications as shown in commit `6de5442f3c`. Don't leave your installation vulnerable! You've got this! Follow these steps and you'll be back in control in no time! 🛡️