CVE-2024-37899
Published: 20 June 2024
Summary
CVE-2024-37899 is a critical-severity Code Injection (CWE-94) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 5.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform contains a code injection vulnerability (CWE-94) in its user account management logic. When an administrator disables a user account, the target user's profile page is rendered using the administrator's full rights rather than the user's own restricted rights, allowing any executable content placed in the profile to run with elevated privileges.
A user with only basic edit rights can insert malicious code, such as a Groovy script, into sections of their profile before the account is disabled. An administrator who subsequently clicks the "Disable this account" button will trigger execution of that code, enabling the attacker to achieve confidentiality, integrity, and availability impacts across the instance as reflected in the CVSS 9.0 score.
Official advisories and the linked XWiki Jira issue state that the flaw is fixed in releases 14.10.21, 15.5.5, 15.10.6, and 16.0.0; administrators are directed to upgrade, as no other mitigations are available. The associated EPSS score reached a peak of 0.1752 after disclosure, indicating measurable exploitation interest following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2085
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious…
more
code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about section of your user profile and add `{{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}`. As an admin, go to the user profile and click the "Disable this account" button. Then, reload the page. If the logs show `attacker - Hello from Groovy!` then the instance is vulnerable. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-21611 * https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.