Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14MnFtLXI0d3gtOGdwZ84AAx7T

org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

Impact

It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters form_token=1&action=create.

For instance: http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create will execute the following groovy code: println("hello from groovy!") on the server.

Patches

This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.

Workarounds

It is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue.

References

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-x2qm-r4wx-8gpg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14MnFtLXI0d3gtOGdwZ84AAx7T
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago


CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Percentage: 0.00586
EPSS Percentile: 0.78517

Identifiers: GHSA-x2qm-r4wx-8gpg, CVE-2023-26477
References: Repository: https://github.com/xwiki/xwiki-platform
Blast Radius: 1.0

Affected Packages

maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui
Affected Version Ranges: >= 14.5, < 14.9-rc-1, >= 14.0, < 14.4.6, >= 6.2.4, < 13.10.10
Fixed in: 14.9-rc-1, 14.4.6, 13.10.10