CVE-2024-31465: 
Java vulnerability analysis and mitigation

CVE-2024-31465 affects XWiki Platform, a generic wiki platform. The vulnerability was discovered in versions starting from 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1. The issue allows any user with edit rights on any page to execute arbitrary code on the server by adding an object of type XWiki.SearchSuggestSourceClass to their user profile or any other page (GitHub Advisory).

The vulnerability stems from improper escaping in XWiki.SearchSuggestSourceSheet, which allows code injection through object properties. An attacker can exploit this by adding an object of type XWiki.SearchSuggestSourceClass and setting properties with malicious code that gets executed when the page is viewed with the SearchSuggestSourceSheet. The vulnerability has been assigned a CVSS v3.1 score of 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating its severe impact (NVD).

The vulnerability compromises the confidentiality, integrity, and availability of the entire XWiki installation. It allows privilege escalation from a regular user account to programming rights, enabling unauthorized code execution on the server (GitHub Advisory).

The vulnerability is easily exploitable by any authenticated user with edit rights. An attacker can exploit it by adding a malicious object to their user profile or any editable page and viewing it with the SearchSuggestSourceSheet parameter. A proof of concept involves setting object properties to }}}{{async}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/async}} and accessing the page with ?sheet=XWiki.SearchSuggestSourceSheet (XWIKI Jira).

The vulnerability has been patched in XWiki versions 14.10.20, 15.5.4, and 15.10 RC1. As a workaround, administrators can manually apply the patch to the document XWiki.SearchSuggestSourceSheet if immediate upgrade is not possible (GitHub Advisory).