Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PRP: Request XWiki user registration feature RCE (CVE-2024-21650) #366

Open
YuriyPobezhymov opened this issue Jan 11, 2024 · 2 comments · May be fixed by #387
Open

PRP: Request XWiki user registration feature RCE (CVE-2024-21650) #366

YuriyPobezhymov opened this issue Jan 11, 2024 · 2 comments · May be fixed by #387
Assignees
@YuriyPobezhymov
Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted

Comments

@YuriyPobezhymov
Copy link
Contributor

YuriyPobezhymov commented Jan 11, 2024 •
edited

Hello.

I would like to start implementing a plugin to detect RCE attack through its user registration feature.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-21650
https://jira.xwiki.org/browse/XWIKI-21173

Description:
XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests.

Versions:

= 2.2, < 14.10.17
= 15.0-rc-1, < 15.5.3
= 15.6-rc-1, < 15.8-rc-1

Cleanup:
I didn't found account deleting functionality for regular user, but I think I'm able to change "first name" programmatically to something random after registration to remove payload from there.

Thanks.
@tooryx
Copy link
Member

tooryx commented Jan 22, 2024

Hi @YuriyPobezhymov,

Thanks for your request! This vulnerability is in scope for the reward program. Please submit our participation form and you can start working on the development.

Please keep in mind that the Tsunami Scanner Team will only be able to work at one issue at a time for each participant so please hold on the implementation work for any other requests you might have.

Thanks!

This was referenced Jan 31, 2024
Closed
Open
@YuriyPobezhymov
Copy link
Contributor Author

YuriyPobezhymov commented Jan 31, 2024 •
edited

I made PR for this issue.
My decision for cleanup purpose is to make first name contain "Delete me!" text, so admin will able to see it in user list and able to delete him then.

@tooryx tooryx added the Contributor main The main issue a contributor is working on (top of the contribution queue). label Feb 1, 2024
@tooryx tooryx linked a pull request Feb 1, 2024 that will close this issue
add plugin CVE-2024-21650 #387
Open
@YuriyPobezhymov YuriyPobezhymov mentioned this issue May 6, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@YuriyPobezhymov YuriyPobezhymov

Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

add plugin CVE-2024-21650 YuriyPobezhymov/tsunami-security-scanner-plugins
2 participants
@tooryx @YuriyPobezhymov