{"id":"GHSA-2r87-74cx-2p7c","summary":"XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList","details":"### Impact\nAny user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on a instance, as a connected user without script nor programming rights, go to your user profile and add an object of type `XWiki.WikiMacroClass`. Set \"Macro Id\", \"Macro Name\" and \"Macro Code\" to any value, \"Macro Visibility\" to `Current User` and \"Macro Description\" to `{{async}}{{groovy}}println(\"Hello from User macro!\"){{/groovy}}{{/async}}`.\nSave the page, then go to `\u003chost\u003e/xwiki/bin/view/XWiki/XWikiSyntaxMacrosList`.\nIf the description of your new macro reads \"Hello from User macro!\", then your instance is vulnerable.\n\n### Patches\nThis vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0.\n\n### Workarounds\nIt is possible to manually apply [this patch](https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3#diff-92fee29683e671b8bc668e3cf4295713d6259f715e3954876049f9de77c0a9ef) to the page `XWiki.XWikiSyntaxMacrosList`.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-22030\n* https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3","aliases":["CVE-2024-55877"],"modified":"2024-12-12T22:33:07Z","published":"2024-12-12T19:21:06Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-12-12T19:21:06Z","nvd_published_at":"2024-12-12T20:15:21Z","cwe_ids":["CWE-94","CWE-96"]},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2r87-74cx-2p7c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55877"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22030"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-help-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-help-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.7-rc-1"},{"fixed":"15.10.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-2r87-74cx-2p7c/GHSA-2r87-74cx-2p7c.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-help-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-help-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-rc-1"},{"fixed":"16.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-2r87-74cx-2p7c/GHSA-2r87-74cx-2p7c.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-help-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-help-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.5.0-rc-1"},{"fixed":"16.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-2r87-74cx-2p7c/GHSA-2r87-74cx-2p7c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}