Critical · published April 15, 2023
🚨 Any user with view rights can execute arbitrary code in XWiki! This vulnerability is a game-changer, and it all starts with an improperly escaped parameter in a default macro! 🔥 Think of it like a restaurant where anyone with a reservation can sneak into the kitchen and whip up whatever they want. Just as a chef wouldn't allow diners to commandeer the stove, your application shouldn't allow arbitrary code execution from merely viewing a page. An attacker could gain full access to your XWiki installation, potentially manipulating data, stealing sensitive information, or even taking the entire system hostage! The consequences could be absolutely devastating, especially since this vulnerability is exploitable through commonly accessible documents.
Think of it like a restaurant where anyone with a reservation can sneak into the kitchen and whip up whatever they want. Just as a chef wouldn't allow diners to commandeer the stove, your application shouldn't allow arbitrary code execution from merely viewing a page. The vulnerability stems from improper escaping of macro parameters in the legacy notification activity macro, allowing users to run arbitrary Groovy, Python, or Velocity code simply by having view rights.
An attacker could gain full access to your XWiki installation, potentially manipulating data, stealing sensitive information, or even taking the entire system hostage! The consequences could be absolutely devastating, especially since this vulnerability is exploitable through commonly accessible documents. To protect yourself, patch your XWiki installation to version 13.10.11, 14.4.7, or 14.10 immediately! Additionally, audit your user permissions to ensure that only trusted individuals have access to view rights on sensitive documents. You've got this! Stay vigilant and secure your XWiki environment with these steps! 🛡️