Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-48293

CVE-2023-48293: Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-48293
GHSA ID
GHSA-4f4c-rhjv-4wgv
EPSS Score
0.72275%
CWE
CWE-352
Published
11/20/2023
Updated
11/20/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.contrib:xwiki-application-admintoolsmaven< 4.5.14.5.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from missing CSRF protections in the query execution flow. The commit diff shows the patched version added a 'form_token' parameter to SQLTools.getForm and added CSRF validation checks in Query.xml/QueryOnXWiki.xml. The original getForm method (without the token) allowed form submissions to execute arbitrary database queries without CSRF validation. This function is directly responsible for rendering the vulnerable form interface, making it the root enabler of the CSRF vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * *SR* vuln*r**ility in t** qu*ry on XWiki tool *llows *x**utin* *r*itr*ry **t***s* qu*ri*s on t** **t***s* o* t** XWiki inst*ll*tion. *mon* ot**r t*in*s, t*is *llows mo*i*yin* *n* **l*tin* *ll **t* o* t** wiki. T*is *oul* ** *ot* us** to

Reasoning

T** vuln*r**ility st*mm** *rom missin* *SR* prot**tions in t** qu*ry *x**ution *low. T** *ommit *i** s*ows t** p*t**** v*rsion ***** * '*orm_tok*n' p*r*m*t*r to `SQLTools.**t*orm` *n* ***** *SR* v*li**tion ****ks in `Qu*ry.xml`/`Qu*ryOnXWiki.xml`. T*