XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml

Summary

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

Timeline

1. Nov 23, 2022, 12:00 AM UTCCVE published
2. Apr 22, 2025, 3:40 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

3. Apr 22, 2025, 4:01 PM UTCRecord last updated

Affected versions

• xwiki xwiki-platform

  From 5.0-milestone-1 · fixed in 13.10.7; From 14.0.0 · fixed in 14.4.2

• org.xwiki.platform:xwiki-platform-attachment-uiMaven

  From 5.0-milestone-1 · fixed in 13.10.7

• org.xwiki.platform:xwiki-platform-attachment-uiMaven

  From 14.0.0 · fixed in 14.4.2

References 2