ExploitCVE-2024-21650
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
Summary
XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests.
Impact
The vulnerability allows attackers to execute arbitrary code on the target system. This can lead to complete system compromise, including unauthorized access to sensitive data, modification of system files, and potential further exploitation of the network. The attack can be carried out remotely without any user interaction or special privileges, making it particularly dangerous.
Exploitation
One proof-of-concept exploit is available on xwiki.org. Its exploitation has been reported by various sources, including vulners.com.
Patch
A patch is available. XWiki has released fixed versions to address this vulnerability. Users should upgrade to XWiki version 15.5.3, 15.7.1, or 14.10.17, depending on their current version.
Mitigation
1. Immediately update XWiki to the latest patched version (15.5.3, 15.7.1, or 14.10.17). 2. If immediate patching is not possible, consider temporarily disabling user registration for guests. 3. Implement strong input validation and sanitization for user registration fields. 4. Monitor system logs for any suspicious activities, especially related to user registration. 5. Conduct a thorough security audit of the XWiki installation to identify any potential compromises.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
Detection for the vulnerability has been added to Qualys (996555)
NVD published the first details for CVE-2024-21650
Feedly found the first article mentioning CVE-2024-21650. See article
EPSS Score was set to: 0.59% (Percentile: 75.8%)
Attacks in the wild have been reported by Vulners.com RSS Feed. See article
A CVSS base score of 9.8 has been assigned.