Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability described is a missing authorization check when listing attachments via REST API endpoints. The primary commit 'a43e933ddeda17dad1772396e1757998260e9342' shows that the getAttachments method in org.xwiki.rest.internal.resources.BaseAttachmentsResource was modified to add an explicit authorization check (.filter(a -> authorization.hasAccess(Right.VIEW, a.getReference()))). This indicates that, prior to this patch, this method did not correctly filter attachments based on user rights, which is the core of the vulnerability.
The getAttachments methods in the concrete resource implementation classes (AttachmentsResourceImpl, SpaceAttachmentsResourceImpl, and WikiAttachmentsResourceImpl) are the public-facing REST API handlers. These methods call super.getAttachments(...), which refers to the method in BaseAttachmentsResource. Therefore, these subclass methods were vulnerable because they utilized the flawed BaseAttachmentsResource.getAttachments method. The patch to the base class effectively remediated the vulnerability for all these public endpoints. These functions would appear in a runtime profile when the vulnerability is triggered, as they are part of the call chain processing the request and returning the unfiltered attachment list.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 1.8.1, < 14.10.22 | 14.10.22 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 15.0-rc-1, < 15.10.12 | 15.10.12 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 16.0.0-rc-1, < 16.4.3 | 16.4.3 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 16.5.0-rc-1, < 16.7.0 | 16.7.0 |
