Critical · published June 24, 2024
🚨 A crafty user can manipulate included content, impersonating authors with a single macro call in XWiki! 🔥 Think of it like a restaurant where the chef serves a dish with the name of a famous chef on the menu, but anyone can switch the order without anyone checking. If the chef's signature dish is altered, diners might be misled about who really cooked it! This sneaky vulnerability allows any user who can modify the target document to hijack the rights of the original author, potentially leading to unauthorized actions or malicious content being spread under a trusted name. This could have devastating consequences for trust and integrity within your wiki!
Think of it like a restaurant where the chef serves a dish with the name of a famous chef on the menu, but anyone can switch the order without anyone checking. If the chef's signature dish is altered, diners might be misled about who really cooked it! The XWiki `{{include reference="targetdocument"}}` macro executes the included content with the rights of the includer instead of the author, allowing malicious modifications without proper authorization checks.
This sneaky vulnerability allows any user who can modify the target document to hijack the rights of the original author, potentially leading to unauthorized actions or malicious content being spread under a trusted name. This could have devastating consequences for trust and integrity within your wiki! To protect your XWiki instance, upgrade to version 15.0 RC1 immediately. Review and audit permissions for users who can modify target documents, and consider implementing stricter access controls. Don't leave your wiki vulnerable! You've got this! Follow these steps, and you'll be back to a secure environment in no time. 🛡️