XWiki Platform permite execução remota de código a partir de uma conta de usuário

This vulnerability allows an unprivileged user to execute arbitrary code on the XWiki server with administrator privileges. The attack involves crafting a user profile containing Groovy code (e.g., {{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}) and then persuading an administrator to disable that user account. Upon disabling, the profile's code is executed under the administrator's context, granting the attacker full control over the system. The potential impact includes data breaches, system compromise, and complete takeover of the XWiki instance. This is a high-impact vulnerability due to the ease of exploitation and the severe consequences of a successful attack.

Organizations utilizing XWiki Platform Oldcore, particularly those with multiple administrators or shared administrative accounts, are at significant risk. Systems with legacy configurations or those lacking robust user access controls are especially vulnerable. Environments where user profiles are frequently modified or where user input is not adequately sanitized are also at increased risk.

• java / server:

ps aux | grep -i groovy

• java / server:

find /opt/xwiki -name "*.groovy" -print

• java / server:

journalctl -u xwiki -f | grep "attacker"

1. 2024-06-20Disclosure

   disclosure

1. Reservado2024-06-10
2. Publicada2024-06-20
3. Modificada2025-02-05
4. EPSS atualizado2026-04-02

The primary mitigation is to immediately upgrade XWiki Platform Oldcore to version 14.10.21 or later. Prior to upgrading, it is crucial to back up the XWiki instance to ensure data recovery in case of issues. If an upgrade is not immediately feasible, consider restricting administrator access and closely monitoring user account activity for suspicious modifications. While a direct workaround is not available, implementing strict input validation and sanitization on user profile data could reduce the attack surface, though this is not a substitute for patching. After upgrading, confirm the fix by attempting to disable a user account with a malicious profile and verifying that the Groovy code is not executed.