Critical · published November 6, 2023
CVSS calls it critical at 10.0. It sits in the 99.8th percentile for exploit probability.
🔥 An unauthenticated user can execute Groovy code on your XWiki instance just by accessing a specific document — that’s a security nightmare waiting to happen! ⚠️ Think of it like leaving your front door unlocked and your neighbors having free access to your home — they can mess with your stuff at will! This vulnerability allows anyone with read access to the `XWiki.AdminSheet` document to run any code they want, compromising your entire wiki. If an attacker gets in, they could fully compromise your XWiki instance, tampering with data, injecting malicious scripts, or even taking control of your whole server. The consequences could be absolutely devastating, impacting confidentiality, integrity, and availability across the board!
Think of it like leaving your front door unlocked and your neighbors having free access to your home — they can mess with your stuff at will! This vulnerability allows anyone with read access to the `XWiki.AdminSheet` document to run any code they want, compromising your entire wiki. This vulnerability arises because XWiki fails to properly escape the section URL parameter used to display admin sections. Thus, any user with read access can run arbitrary Groovy code, leading to potential remote code execution.
If an attacker gets in, they could fully compromise your XWiki instance, tampering with data, injecting malicious scripts, or even taking control of your whole server. The consequences could be absolutely devastating, impacting confidentiality, integrity, and availability across the board! Upgrade to XWiki version 14.10.14, 15.6 RC1, or 15.5.1 immediately to patch this vulnerability. If an upgrade isn’t possible, you can apply the fix manually using commit `fec8e0e53f9`. For extra safety, consider restricting view rights for guests on the `XWiki.AdminSheet` document. You've got this! By following these steps, you’ll be well on your way to securing your XWiki instance. 🛡️