XWiki Denial of Service attack through attachments

CVE-2024-21651

Summary

The XWiki Platform is a versatile wiki application that provides runtime services for various built applications. A vulnerability exists within the platform due to improper handling of file attachments. Specifically, a user with the ability to attach files can exploit this weakness by submitting a specially crafted TAR file that manipulates file modification times headers. When this malformed file is parsed by the Tika library, it can lead to excessive CPU consumption, resulting in denial of service for users. This issue has been addressed in recent updates, including XWiki versions 14.10.18, 15.5.3, and 15.8 RC1, making it essential for users to upgrade to these patched versions to ensure system integrity.

References