Critical · published October 25, 2023
🚨 A specially crafted file name can write to any location on your server, turning your XWiki installation into an attacker's playground! 🔥 Think of it like a sneaky delivery driver who, instead of just dropping off a package, decides to leave it in a different apartment within your building — one that's not theirs! In this case, your server is the building, and the crafted file name is the misdelivered package. If exploited, an attacker could replace critical files, including the `jar` files of extensions, effectively allowing arbitrary Java code execution. This could lead to a complete compromise of confidentiality, integrity, and availability for your XWiki installation—imagine all your wiki secrets spilled and the whole thing brought to a standstill!
Think of it like a sneaky delivery driver who, instead of just dropping off a package, decides to leave it in a different apartment within your building — one that's not theirs! In this case, your server is the building, and the crafted file name is the misdelivered package. This vulnerability in XWiki allows a malicious user to upload an attachment with a specially crafted file name, leveraging the office converter feature, which can write the attachment's content to an attacker-controlled location on the server.
If exploited, an attacker could replace critical files, including the `jar` files of extensions, effectively allowing arbitrary Java code execution. This could lead to a complete compromise of confidentiality, integrity, and availability for your XWiki installation—imagine all your wiki secrets spilled and the whole thing brought to a standstill! Immediately patch your XWiki installation to versions 14.10.8 or 15.3-rc-1. If you can't patch right away, disable the office converter to prevent exploitation while you work on the update. Be sure to review file permissions too! You've got this! With these steps, you can secure your XWiki and keep your data safe! 🛡️