Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
A critical vulnerability in XWiki allows any user with edit rights on any page to perform arbitrary remote code execution. This is achieved by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or any other page. The vulnerability affects the entire XWiki installation, compromising its confidentiality, integrity, and availability. It impacts XWiki versions from 9.2 up to, but not including, 14.10.21, from 15.0 up to, but not including, 15.5.5, and from 15.6 up to, but not including, 15.10.2.
This vulnerability has severe impacts: 1. Remote Code Execution: Attackers can execute arbitrary code on the server, potentially leading to full system compromise. 2. Privilege Escalation: Users with only edit rights can gain programming-level access, bypassing intended access controls. 3. Data Breach: The confidentiality impact is high, meaning sensitive information stored in the XWiki installation could be exposed. 4. System Integrity: With high integrity impact, attackers could modify or delete critical data and configurations. 5. Service Disruption: The high availability impact suggests that attackers could potentially crash or render the XWiki service inoperable. The attack is particularly dangerous as it requires only low privileges (edit rights) and no user interaction, making it relatively easy to exploit. The CVSS v3.1 base score is 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. The vulnerability was publicly disclosed on July 31, 2024, and a patch was added on the same day according to the Github Advisory. Multiple patch commits have been made available on GitHub. Users should update to XWiki versions 14.10.21, 15.5.5, or 15.10.2 or later, depending on their current version.
1. Apply the patch immediately: Update to the latest version of XWiki as soon as possible. 2. Access Control Review: Temporarily restrict edit rights to trusted users only until the patch can be applied. 3. Monitor Logs: Actively monitor for suspicious activities, particularly looking for unauthorized access attempts or unexpected log entries. 4. User Education: Inform users about the risks of this vulnerability and the importance of responsible editing practices. 5. Network Segmentation: If possible, isolate XWiki instances from critical systems until patching is complete. 6. Backup: Ensure all data is securely backed up in case of any compromise. 7. Security Assessment: After patching, conduct a thorough security assessment to ensure no unauthorized changes were made to the system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A CVSS base score of 9.9 has been assigned.
Feedly found the first article mentioning CVE-2024-37901. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-37901
EPSS Score was set to: 0.04% (Percentile: 10.7%)
Detection for the vulnerability has been added to Qualys (731743)
A CVSS base score of 8.8 has been assigned.