Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29253

CVE-2022-29253: Path Traversal in XWiki Platform

2.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29253
GHSA ID
GHSA-9qrp-h7fw-42hg
EPSS Score
0.19957%
CWE
CWE-22
Published
6/1/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-oldcoremaven>= 8.3-rc-1, < 13.10.313.10.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path sanitization in the classloader template resolution logic. The commit patching the issue adds critical path normalization and a directory traversal check to 'getClassloaderTemplate' in InternalTemplateManager.java, specifically verifying that the normalized path starts with the expected 'prefixPath'. This directly addresses the path traversal vulnerability described in the advisory. The function's pre-patch behavior of blindly concatenating user-controlled 'templateName' with 'suffixPath' (later renamed to 'prefixPath') without validation is the root cause.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t On* **n *sk *or *ny *il* lo**t** in t** *l*sslo***r usin* t** t*mpl*t* *PI *n* * p*t* wit* ".." in it. *or *x*mpl* ``` {{t*mpl*t* n*m*="../xwiki.**m.xml"/}} ``` To our knownl**** non* o* t** *v*il**l* *il*s o* t** *l*sslo***r in XWiki

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* s*nitiz*tion in t** *l*sslo***r t*mpl*t* r*solution lo*i*. T** *ommit p*t**in* t** issu* ***s *riti**l p*t* norm*liz*tion *n* * *ir**tory tr*v*rs*l ****k to '**t*l*sslo***rT*mpl*t*' in Int*rn*lT*mpl*t*M*n***