Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-31982

CVE-2024-31982:
XWiki Platform: Remote code execution as guest via DatabaseSearch

10

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-31982
GHSA ID
GHSA-2858-8cfx-69m9
EPSS Score
0.99902%
CWE
CWE-94
Published
4/10/2024
Updated
1/21/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-search-uimaven>= 2.4-milestone-1, < 14.10.2014.10.20
org.xwiki.platform:xwiki-platform-search-uimaven>= 15.0-rc-1, < 15.5.415.5.4
org.xwiki.platform:xwiki-platform-search-uimaven>= 15.6-rc-1, < 15.10-rc-115.10-rc-1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The key vulnerability stemmed from how the DatabaseSearch template handled RSS feed generation. The pre-patch version used unsafe triple-brace syntax to render feed output, which doesn't escape content and allows XWiki syntax interpretation. Attackers could inject closing template tags followed by Groovy code, which would be executed during rendering. The patch replaced this with direct response writing, bypassing template processing. The vulnerable pattern is clearly shown in the diff where {{$xwiki.feed.getFeedOutput(...)}} was removed and replaced with safe output handling methods.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t XWiki's **t***s* s**r** *llows r*mot* *o** *x**ution t*rou** t** s**r** t*xt. T*is *llows r*mot* *o** *x**ution *or *ny visitor o* * pu*li* wiki or us*r o* * *los** wiki *s t** **t***s* s**r** is *y ****ult ****ssi*l* *or *ll us*rs. T*is i

Reasoning

T** k*y vuln*r**ility st*mm** *rom *ow t** `**t***s*S**r**` t*mpl*t* **n*l** RSS **** **n*r*tion. T** pr*-p*t** v*rsion us** uns*** tripl*-*r*** synt*x to r*n**r **** output, w*i** *o*sn't *s**p* *ont*nt *n* *llows `XWiki` synt*x int*rpr*t*tion. *tt*