| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-flamingo-theme-ui | ≥ 14.0, < 14.4.6≥ 14.5, < 14.9-rc-1≥ 6.2.4, < 13.10.10 | 14.4.614.9-rc-113.10.10 |
| xwiki | ≥ 14.0, < 14.4.6≥ 14.5, < 14.9≥ 6.2.4, < 13.10.10 | 14.4.614.913.10.10 |
It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters form_token=1&action=create.
For instance: http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create will execute the following groovy code: println("hello from groovy!") on the server.
This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.
It is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free