CVE-2023-36468 : Security Advisory and Response

This article provides detailed information about CVE-2023-36468, focusing on understanding the vulnerability, its impact, technical details, and mitigation strategies.

Understanding CVE-2023-36468

CVE-2023-36468 relates to the XWiki Platform and its vulnerability to exploitation even after upgrading, affecting the confidentiality, integrity, and availability of the installation.

What is CVE-2023-36468?

XWiki Platform is a generic wiki platform that offers runtime services for applications. Vulnerability in XWiki allows exploitation even after an upgrade, potentially leading to remote code execution.

The Impact of CVE-2023-36468

The vulnerability affects the confidentiality, integrity, and availability of the XWiki installation. It can be exploited remotely for malicious activities and poses a critical threat to the security of the platform.

Technical Details of CVE-2023-36468

The vulnerability stems from incomplete cleanup in XWiki documents, making it possible to exploit the system even after upgrading to a fixed version.

Vulnerability Description

Upgrading XWiki does not prevent the exploitation of vulnerable documents, allowing for the continuation of security risks even after patches are applied.

Affected Systems and Versions

XWiki Platform versions from >= 2.0 to < 14.10.7 and >= 15.0-rc-1 to < 15.2-rc-1 are affected by this vulnerability.

Exploitation Mechanism

By adding

rev=1.1

to the URL after upgrading XWiki, remote code execution remains possible, compromising the system's security.

Mitigation and Prevention

To address CVE-2023-36468, immediate steps must be taken to secure XWiki installations and prevent further exploitation.

Immediate Steps to Take

Admins should manually delete old revisions of affected documents or use a script to identify and remove vulnerable versions. Additionally, upgrading to patched versions is crucial.

Long-Term Security Practices

Regularly monitoring and updating XWiki installations, implementing security best practices, and ensuring system integrity can help prevent future vulnerabilities.

Patching and Updates

XWiki versions 14.10.7 and 15.2RC1 have been patched to restrict execution of old revisions and disable script macros. Applying these updates is vital to mitigate the risk of exploitation.