Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue in the XWiki Platform, specifically within the ssx and jsx endpoints. The root cause lies in the org.xwiki.classloader.internal.ClassLoaderUtils class, which is responsible for resolving resource paths. The methods getResource and getResourceAsStream in this class use a private helper method, resolveResourceName, to process resource paths. Before the patch, resolveResourceName used Paths.get(fullPath).normalize() to sanitize the path. However, this normalization was insufficient as it didn't account for how some application servers, like Tomcat, handle leading slashes. This allowed an attacker to craft a malicious path with leading slashes (e.g., /../../WEB-INF/xwiki.cfg) to bypass the security checks and access arbitrary files on the server. The patch addresses this by stripping any leading slashes from the resource path before it is normalized, thus preventing the path traversal attack. The vulnerable functions are the public methods getResource and getResourceAsStream as they are the entry points for the vulnerable logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.commons:xwiki-commons-classloader-api | maven | >= 4.2-milestone-2, < 16.10.17 | 16.10.17 |
| org.xwiki.commons:xwiki-commons-classloader-api | maven | >= 17.0.0-rc-1, < 17.4.9 | 17.4.9 |
| org.xwiki.commons:xwiki-commons-classloader-api | maven | >= 17.5.0, < 17.10.3 | 17.10.3 |
| org.xwiki.commons:xwiki-commons-classloader-api | maven | >= 18.0.0-rc-1, < 18.1.0-rc-1 | 18.1.0-rc-1 |
