CVE-2023-40573 : Security Advisory and Response

XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution.

Understanding CVE-2023-40573

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The platform supports scheduled jobs that contain Groovy scripts. The vulnerability in question arises from the job checking the content author incorrectly.

What is CVE-2023-40573?

The CVE-2023-40573 vulnerability in XWiki Platform occurs when Groovy jobs mistakenly verify the content author, leading to a flaw that allows for remote code execution.

The Impact of CVE-2023-40573

An attacker with edit rights on the wiki can exploit this vulnerability, especially when combined with a CSRF vulnerability in the job scheduler. Successful exploitation can result in remote code execution, indicated by an error log entry with "Job content executed". This could potentially lead to unauthorized access and control over the affected system.

Technical Details of CVE-2023-40573

The CVSS score for CVE-2023-40573 is 9.1, indicating a critical severity level with high impact on confidentiality, integrity, and availability.

Vulnerability Description

The vulnerability stems from improper access control in the way Groovy jobs check the content author, allowing attackers to execute remote code.

Affected Systems and Versions

Vendor: XWiki
Product: XWiki-Platform
Affected Versions:
XWiki < 14.10.9
XWiki >= 1.3
XWiki >= 15.0-rc-1, < 15.4-rc-1

Exploitation Mechanism

By manipulating or adding a job script to a document without modifying the content author, attackers can exploit this vulnerability, especially when combined with a CSRF flaw in the job scheduler.

Mitigation and Prevention

It is crucial to take immediate steps to address and mitigate the risks posed by CVE-2023-40573.

Immediate Steps to Take

Update XWiki to versions 14.10.9 or 15.4RC1 that contain the necessary patches to address this vulnerability.
Monitor and restrict access to sensitive areas within the wiki to prevent unauthorized execution of code.

Long-Term Security Practices

Regularly update and patch the XWiki platform to ensure all security fixes are applied promptly.
Conduct regular security audits to identify and address any potential vulnerabilities within the wiki platform.

Patching and Updates

Stay informed about security advisories and updates from XWiki to ensure timely application of patches and security fixes.