CVE-2024-31465

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

Published: Apr 10, 2024

010
CVSS 9.9EPSS 0.04%Critical
CVE info copied to clipboard

Any user with edit right on any page can execute any code on the server by adding an object of type XWiki.SearchSuggestSourceClass to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, as a user without script nor programming rights, add an object of type XWiki.SearchSuggestSourceClass to your profile page. On this object, set every possible property to }}}{{async}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/async}} (i.e., name, engine, service, query, limit and icon). Save and display the page, then append ?sheet=XWiki.SearchSuggestSourceSheet to the URL. If any property displays as Hello from Groovy!}}}, then the instance is vulnerable.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Timeline

Vendor Advisory

GitHub Advisories released a security advisory.

Apr 10, 2024 at 7:35 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (998035)

Apr 10, 2024 at 7:53 AM
CVSS

A CVSS base score of 9.9 has been assigned.

Apr 10, 2024 at 5:21 PM / github_advisories
First Article

Feedly found the first article mentioning CVE-2024-31465. See article

Apr 10, 2024 at 5:24 PM / GitHub Advisory Database
CVE Assignment

NVD published the first details for CVE-2024-31465

Apr 10, 2024 at 8:15 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.2%)

Apr 11, 2024 at 9:55 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.6%)

May 6, 2024 at 9:45 PM
Static CVE Timeline Graph

Affected Systems

Xwiki/xwiki
+null more

Patches

Github Advisory
+null more

Attack Patterns

CAPEC-35: Leverage Executable Code in Non-Executable Files
+null more

Vendor Advisory

[GHSA-34fj-r5gq-7395] XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
To reproduce on an instance, as a user without script nor programming rights, add an object of type XWiki.SearchSuggestSourceClass to your profile page. To reproduce on an instance, as a user without script nor programming rights, add an object of type XWiki.SearchSuggestSourceClass to your profile page.

News

CPAI-2024-0218
The post CPAI-2024-0218 appeared first on Check Point Software .
NA - CVE-2024-31465 - XWiki Platform is a generic wiki platform....
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the...
CVE-2024-31465
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the document `XWiki.SearchSuggestSourceSheet`.
advng accepted merge request !27725: Add CVE-2024-31465 to maven/org.xwiki.platform/xwiki-platform-search-ui at GitLab.org / security-products / advisory-dat...
CVE-2024-31465
This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be...
See 2 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Changed
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI