CVE-2024-55879
published 2024-12-12CVE-2024-55879: XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.04%
59.8th percentile
XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | >= 16.0.0 < 16.3.0 | 16.3.0 |
| xwiki | xwiki | >= 2.3 < 15.10.9 | 15.10.9 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
XWiki allows RCE from script right in configurable sections
osv·2024-12-12
CVE-2024-55879 [CRITICAL] XWiki allows RCE from script right in configurable sections
XWiki allows RCE from script right in configurable sections
### Impact
Any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on a instance, as a user with script rights, edit your user profile and add an object of type `XWiki.ConfigurableClass` ("Custom configurable sections").
Set "Display in section" and "Display in category" to `other`, "Scope" to `Wiki and all spaces` and "Heading" to:
```
#set($codeToExecute = 'Test') #set($codeToExecuteResult = '{{async}}{{groovy}}services.logging.getLogger("attacker").error("Attack from Heading succeeded!"){{/groovy}}{{/async}}')
```
Save the page and view it,
GHSA
XWiki allows RCE from script right in configurable sections
ghsa·2024-12-12
CVE-2024-55879 [CRITICAL] CWE-862 XWiki allows RCE from script right in configurable sections
XWiki allows RCE from script right in configurable sections
### Impact
Any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on a instance, as a user with script rights, edit your user profile and add an object of type `XWiki.ConfigurableClass` ("Custom configurable sections").
Set "Display in section" and "Display in category" to `other`, "Scope" to `Wiki and all spaces` and "Heading" to:
```
#set($codeToExecute = 'Test') #set($codeToExecuteResult = '{{async}}{{groovy}}services.logging.getLogger("attacker").error("Attack from Heading succeeded!"){{/groovy}}{{/async}}')
```
Save the page and view it,
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-12
Published