Critical · published April 15, 2023
🚨 Just by viewing a common document, an attacker can execute arbitrary code in XWiki—like a clever magician pulling a rabbit out of a hat! 🔥 This is like having an open mic night where anyone can hop up and start performing their own routine—no vetting required! The notification preferences macros are the stage, and if the wrong person grabs the mic, it could lead to chaos. An attacker with view rights can run their own Groovy, Python, or Velocity code, potentially gaining full control of the XWiki installation. This means they could access, modify, or delete any information, leading to disastrous consequences for any organization relying on XWiki for critical documentation.
This is like having an open mic night where anyone can hop up and start performing their own routine—no vetting required! The notification preferences macros are the stage, and if the wrong person grabs the mic, it could lead to chaos. The vulnerability stems from improper escaping of user parameters in the notification filters macro, which allows any user with view permissions to execute arbitrary code on the server.
An attacker with view rights can run their own Groovy, Python, or Velocity code, potentially gaining full control of the XWiki installation. This means they could access, modify, or delete any information, leading to disastrous consequences for any organization relying on XWiki for critical documentation. Secure your installation by upgrading to XWiki versions 13.10.11, 14.4.7, or 14.10 immediately. Review user permissions and ensure only trusted individuals have view rights to sensitive documents. Regularly audit your macros for similar vulnerabilities. You've got this! By following these steps, you’ll keep your XWiki fortress safe and sound! 🛡️