Listen to this Post
How the CVE Works:
The vulnerability resides in the XWiki OIDC (OpenID Connect) authenticator. The token generation endpoint improperly checks user permissions. Any authenticated user possessing only the global “view” right, the most basic access level, can call this endpoint. The flawed authorization logic does not verify if the requester has administrative or explicit write privileges for the target user profile. By simply specifying the profile name of any viewable user in the HTTP request, an attacker can force the application to generate a valid authentication token for that victim. This token can then be used to impersonate the victim user entirely, provided token-based authentication is enabled on the XWiki instance, which is a common configuration for API or external application access.
Platform: XWiki
Version: 2.17.1 – 2.18.1
Vulnerability: Improper Access Control
Severity: Critical
date: 2024-10-06
Prediction: Patch available.
What Undercode Say:
`curl -X POST -H “XWiki-User: attacker” -H “XWiki-Password: attackerpass” “http://xwiki-host/oidc/token/generate?targetUser=admin”`
` Uses generated token to impersonate admin`
`curl -H “Authorization: Bearer [bash]” http://xwiki-host/rest/wikis/query`
How Exploit:
Attacker with view rights authenticates, then sends a crafted POST request to the token generation endpoint specifying a target user. The endpoint returns a valid authentication token for the specified user. The attacker uses this token to gain full access to the victim’s account, bypassing all other permission checks.
Protection from this CVE:
Upgrade to version 2.18.2 immediately. If upgrading is not possible, disable token authentication entirely via the XWiki configuration as a workaround.
Impact:
Full account takeover. Any user with view access can impersonate any other viewable user, including administrators, leading to complete compromise of data and system integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
