Critical · published April 18, 2023
CVSS calls it critical at 10.0. It sits in the 99.6th percentile for exploit probability.
🚨 A crafty code injection lurking in XWiki's notifications could let an attacker escalate privileges from view to programming rights with just a single sneaky parameter! 🔥 Think of it like a restaurant that allows you to submit a suggestion for a new dish right from the menu—if the suggestion box isn't checked, you might end up ordering something completely out of left field! An attacker could exploit this vulnerability to gain elevated access, allowing them to execute arbitrary code on the server—imagine having the keys to the kitchen and being able to change the entire menu! This kind of escalation can lead to unauthorized access to sensitive data and complete control over the wiki environment, which is absolutely devastating.
Think of it like a restaurant that allows you to submit a suggestion for a new dish right from the menu—if the suggestion box isn't checked, you might end up ordering something completely out of left field! This vulnerability arises from a lack of proper escaping in the `since` parameter of the Legacy Notification Administration endpoint, enabling XWiki syntax injection that can lead to privilege escalation and subsequent code execution.
An attacker could exploit this vulnerability to gain elevated access, allowing them to execute arbitrary code on the server—imagine having the keys to the kitchen and being able to change the entire menu! This kind of escalation can lead to unauthorized access to sensitive data and complete control over the wiki environment, which is absolutely devastating. To secure your XWiki installation, upgrade to XWiki versions 15.0-rc-1, 14.10.3, or 14.4.8 immediately. If you're unable to upgrade, make sure to modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the necessary escaping. For versions below 14.6-rc-1, apply the workaround by adjusting the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to include the missing escape sequences. You've got this! With a little action, you'll keep your XWiki safe and sound! 🛡️