CVE-2023-29507
published 2023-04-16CVE-2023-29507: XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to…
PriorityP339high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.90%
55.2th percentile
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 14.4.1 < 14.4.7 | 14.4.7 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
osv·2023-04-12
CVE-2023-29507 [CRITICAL] org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
### Impact
The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights.
Example of such attack:
```
{{velocity}}
$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')
$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')
$doc.getRenderedContent()
{{/velocity}}
```
### Patches
The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
### Workarounds
There no easy workaround apart of upgrading.
### References
* https://jira.xwiki.org/browse/XWIKI-20380
* https://github.com/xwiki/
GHSA
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
ghsa·2023-04-12
CVE-2023-29507 [CRITICAL] CWE-648 org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
### Impact
The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights.
Example of such attack:
```
{{velocity}}
$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')
$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')
$doc.getRenderedContent()
{{/velocity}}
```
### Patches
The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
### Workarounds
There no easy workaround apart of upgrading.
### References
* https://jira.xwiki.org/browse/XWIKI-20380
* https://github.com/xwiki/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4chttps://jira.xwiki.org/browse/XWIKI-20380https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4chttps://jira.xwiki.org/browse/XWIKI-20380https://jira.xwiki.org/browse/XWIKI-20380
2023-04-16
Published