Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-29512

CVE-2023-29512: xwiki-platform-web-templates vulnerable to Eval Injection

9.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-29512
GHSA ID
GHSA-hg5x-3w3x-7g96
EPSS Score
0.83504%
CWE
CWE-74
Published
4/20/2023
Updated
11/4/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 1.0B1, < 13.10.1113.10.11
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 14.0-rc-1, < 14.4.814.4.8
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 14.5, < 14.10.114.10.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing output escaping in Velocity templates that process user-controlled input from XAR attachments. The patch adds $escapetool.xml() escaping to numerous variables that render: 1) Localization strings with dynamic keys, 2) Package metadata fields, 3) Attachment filenames, and 4) User-provided document names. These unescaped outputs in imported.vm, importinline.vm and packagelist.vm templates allowed injection of arbitrary code into the rendered HTML, which could then be interpreted as Velocity/Groovy code due to XWiki's template processing flow. The high confidence comes from direct correlation between patched locations and security advisory descriptions of injection vectors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *ny us*r wit* **it ri**ts on * p*** (*.*., it's own us*r p***), **n *x**ut* *r*itr*ry *roovy, Pyt*on or V*lo*ity *o** in XWiki l***in* to *ull ****ss to t** XWiki inst*ll*tion. T** root **us* is improp*r *s**pin* o* t** in*orm*tion lo****

Reasoning

T** vuln*r**ility st*ms *rom missin* output *s**pin* in V*lo*ity t*mpl*t*s t**t pro**ss us*r-*ontroll** input *rom X*R *tt***m*nts. T** p*t** ***s `$*s**p*tool.xml()` *s**pin* to num*rous v*ri**l*s t**t r*n**r: *) Lo**liz*tion strin*s wit* *yn*mi* k*