Critical · published October 25, 2023
🚨 A crafty URL can hide a malicious code execution in XWiki, turning a simple page creation into a security nightmare! 🔥 Think of it like a restaurant menu where a chef can sneak in a surprise ingredient that isn't visible until you take a bite — and by then, it’s too late! That’s exactly what’s happening here, as attackers can manipulate page titles to execute unwanted scripts without the victim ever knowing until it’s too late. An attacker could effectively trick a victim into executing malicious code by simply convincing them to click on a specially crafted link. If the victim has scripting or programming rights, the attacker could gain full access to the XWiki instance — which is absolutely devastating for anyone relying on it for secure collaboration!
Think of it like a restaurant menu where a chef can sneak in a surprise ingredient that isn't visible until you take a bite — and by then, it’s too late! That’s exactly what’s happening here, as attackers can manipulate page titles to execute unwanted scripts without the victim ever knowing until it’s too late. This vulnerability in the XWiki Platform allows attackers to execute code by manipulating the title parameter during page creation, where the injected code runs before the title is displayed.
An attacker could effectively trick a victim into executing malicious code by simply convincing them to click on a specially crafted link. If the victim has scripting or programming rights, the attacker could gain full access to the XWiki instance — which is absolutely devastating for anyone relying on it for secure collaboration! Upgrade to `org.xwiki.platform:xwiki-platform-web` version 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` versions 14.10.12 and 15.5-rc-1 immediately. Alternatively, manually patch your installation with the updated files to ensure the title is visible during the first creation step — that way, users can spot any malicious tricks! You can fix this! Take those steps and lock this vulnerability down for good. 🛡️