CVE-2023-37909
Published: 25 October 2023
Summary
CVE-2023-37909 is a critical-severity Eval Injection (CWE-95) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform versions from 5.1-rc-1 through 14.10.7 and 15.2 allow any user able to edit their own profile page to execute arbitrary script macros, including Groovy and Python, because the Menu.UIExtensionSheet document lacked proper escaping of user-controlled content. The flaw is tracked as CWE-95 and CWE-94 and carries a CVSS 3.1 score of 9.9.
An authenticated attacker with only profile-edit rights can therefore obtain unrestricted remote code execution and read/write access to every wiki document. No additional privileges or user interaction are required, and the attack can be performed over the network.
The project has released XWiki 14.10.8 and 15.3-rc-1, which add output escaping to the affected sheet. The same three-line change can be applied manually as a workaround, and the fix is documented in the GitHub Security Advisory GHSA-v2rr-xw95-wcjx together with the corresponding Jira issue XWIKI-20746.
EPSS remains flat at 0.1046 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2811
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary…
more
script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.