CVE-2024-37899: RCE in XWiki Platform Oldcore

This vulnerability allows an unprivileged user to execute arbitrary code on the XWiki server with administrator privileges. The attack involves crafting a user profile containing Groovy code (e.g., {{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}) and then persuading an administrator to disable that user account. Upon disabling, the profile's code is executed under the administrator's context, granting the attacker full control over the system. The potential impact includes data breaches, system compromise, and complete takeover of the XWiki instance. This is a high-impact vulnerability due to the ease of exploitation and the severe consequences of a successful attack.

1. Reserved2024-06-10
2. Published2024-06-20
3. Modified2025-02-05
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade XWiki Platform Oldcore to version 14.10.21 or later. Prior to upgrading, it is crucial to back up the XWiki instance to ensure data recovery in case of issues. If an upgrade is not immediately feasible, consider restricting administrator access and closely monitoring user account activity for suspicious modifications. While a direct workaround is not available, implementing strict input validation and sanitization on user profile data could reduce the attack surface, though this is not a substitute for patching. After upgrading, confirm the fix by attempting to disable a user account with a malicious profile and verifying that the Groovy code is not executed.