Listen to this Post
This vulnerability in XWiki Platform (versions >= 15.9-rc-1, < 15.10.8 and >= 16.0.0-rc-1, < 16.2.0) fails to properly analyze `TextArea` properties with default content types during required rights validation. When editing a page, XWiki normally warns if content (e.g., script macros) gains elevated privileges. However, this check does not apply to `TextArea` fields with default content, allowing attackers to inject malicious scripts.
An attacker without script rights can create a class with a `TextArea` property, then embed a Velocity macro in its content. When an admin edits the page, the script executes without warning, compromising confidentiality, integrity, and availability. Patched in XWiki 15.10.8 and 16.2.0.
DailyCVE Form:
Platform: XWiki Platform
Version: 15.9-16.2
Vulnerability: Rights Bypass
Severity: Critical
Date: 2025-04-29
What Undercode Say:
Exploit:
1. Attacker creates a class with `TextArea`:
public class MaliciousClass {
private String maliciousScript;
// ...
}
2. Inserts Velocity macro:
set($x=77)
3. Admin edits page → script executes.
Protection:
- Upgrade to XWiki 15.10.8/16.2.0.
- Disable `TextArea` scripting:
<xwiki-properties> <security.scripting.restrictions>STRICT</security.scripting.restrictions> </xwiki-properties>
Detection:
grep -r "TextArea.default" /xwiki/config/
Mitigation Commands:
Backup before upgrade sudo xwiki-backup --output /safe/path/ Patch via package manager sudo apt-get update && sudo apt-get install xwiki-platform=16.2.0
Audit Logging:
INSERT INTO security_log (event, user, timestamp)
VALUES ('Rights_Bypass_Attempt', CURRENT_USER(), NOW());
References:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
