XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

CVE-2023-48292

Summary

The XWiki Admin Tools Application has a cross-site request forgery vulnerability, enabling attackers to execute arbitrary shell commands on the server. This is achieved by causing an admin user to load a malicious URL embedded in comments. When the harmful comment is viewed, it can result in the unintended execution of commands, compromising both the integrity and confidentiality of the XWiki installation. A patch for this issue has been released in version 4.5.1, which incorporates a form token check to mitigate the risk. As a precaution, admins are advised to either apply the patch or remove the vulnerability-prone command execution functionality.

References