GHSA-qrvh-r3f2-9h4r
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-rest-server | >= 15.10.6, < 16.10.17 | 16.10.17 |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | >= 17.0.0-rc-1, < 17.4.9 | 17.4.9 |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | >= 17.5.0, < 17.10.3 | 17.10.3 |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | >= 18.0.0-rc-1, < 18.1.0-rc-1 | 18.1.0-rc-1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
`POST /wikis/{wikiName}` executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki
### Patches
This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
### Workarounds
XWiki is not aware of any workarounds other than adding a rule into an HTTP proxy to prevent access POST request in the `/wikis/{wikiName}[/]` endpoint.
### Resources
* https://jira.xwiki.org/browse/XWIKI-23953
* https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f
### For more information
If there are any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Send an email to the [Security Mailing List](mailto:[email protected])
### Attribution
Reported by Sho Odagiri (GMO Cybersecurity by Ierae, Inc.).
References
External links from the advisory. They lead to third-party sites.