Advisory Details

December 19th, 2024

XWiki.org XWiki SolrSearchMacros text Command Injection Remote Code Execution Vulnerability

ZDI-24-1697
ZDI-CAN-23994

CVE ID
CVSS SCORE 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS XWiki.org
AFFECTED PRODUCTS XWiki
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on affected installations of XWiki.org XWiki. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the text parameter provided to the SolrSearchMacros endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.
ADDITIONAL DETAILS

This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1:
https://www.xwiki.org/xwiki/bin/view/TestReports/
DISCLOSURE TIMELINE
  • 2024-05-06 - Vulnerability reported to vendor
  • 2024-12-19 - Coordinated public release of advisory
  • 2024-12-19 - Advisory Updated
CREDIT John Kwak of Trend Micro Security Research
BACK TO ADVISORIES