[MAVEN:GHSA-X2QM-R4WX-8GPG] org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Impact
It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName
request parameter (URL parameter), in combination with additional parameters form_token=1&action=create
.
For instance: http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create will execute the following groovy code: println("hello from groovy!")
on the server.
Patches
This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.
Workarounds
It is possible to edit FlamingoThemesCode.WebHomeSheet
and manually perform the changes from the patch fixing the issue.
References
- https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284
- https://jira.xwiki.org/browse/XWIKI-19757
For more information
If you have any questions or comments about this advisory:
* Open an issue in Jira XWiki.org
* Email us at Security Mailing List
Package | Affected Version |
---|---|
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | >= 14.5, < 14.9-rc-1 |
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | >= 14.0, < 14.4.6 |
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | >= 6.2.4, < 13.10.10 |
Package | Fixed Version |
---|---|
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | = 14.9-rc-1 |
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | = 14.4.6 |
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | = 13.10.10 |
- ID
- MAVEN:GHSA-X2QM-R4WX-8GPG
- Severity
- critical
- URL
- https://github.com/advisories/GHSA-x2qm-r4wx-8gpg
- Published
-
2023-03-03T22:51:02
(18 months ago) - Modified
-
2023-03-10T15:33:34
(18 months ago) - Rights
- Maven Security Team
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | >= 14.5 < 14.9-rc-1 | |||
Fixed | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | = 14.9-rc-1 | |||
Affected | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | >= 14.0 < 14.4.6 | |||
Fixed | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | = 14.4.6 | |||
Affected | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | >= 6.2.4 < 13.10.10 | |||
Fixed | pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui | org.xwiki.platform | xwiki-platform-flamingo-theme-ui | = 13.10.10 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |