XWiki Platform CSRF (Cross-Site Request Forgery) Remote Code Execution durch die realtime HTML Converter API

The impact of this vulnerability is severe. An attacker can achieve remote code execution with the privileges of an administrator user. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The attack vector involves tricking an administrator into visiting a specially crafted URL or viewing an image containing that URL, potentially through social engineering or malicious content injection. The ability to execute arbitrary code grants the attacker a high degree of control over the affected XWiki instance and potentially the underlying infrastructure.

Organizations using XWiki Platform in environments where administrators regularly interact with external content or visit potentially untrusted URLs are at significant risk. Shared hosting environments where multiple users share an XWiki instance are particularly vulnerable, as a compromised user could potentially exploit this vulnerability to gain access to other users' data.

• linux / server:

journalctl -u xwiki | grep -i "scripting macros"

• java / platform:

ps -ef | grep -i "groovy"

• generic web:

curl -I <xwiki_url>/xwiki/bin/view/Main/Admin  # Check for unusual headers or redirects

1. 2024-04-10Disclosure

   disclosure

1. Reserviert2024-04-08
2. Veröffentlicht2024-04-10
3. Geändert2025-02-21
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade XWiki Platform to version 14.10.19 or later. If immediate upgrading is not possible, consider disabling the realtime editor feature as a temporary workaround. Review XWiki access controls to ensure only authorized users have administrative privileges. Implement strict URL filtering and input validation to prevent malicious URLs from being displayed to administrators. Monitor XWiki logs for suspicious activity, particularly related to script execution or unusual URL requests. There are no specific Sigma or YARA rules readily available for this vulnerability, but generic Groovy/Python script execution detection rules should be considered.