CVE-2024-31984: 
Java vulnerability analysis and mitigation

CVE-2024-31984 affects XWiki Platform, a generic wiki platform. The vulnerability was discovered in versions starting from 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1. The issue allows any user with the ability to edit space titles (a default permission) to execute arbitrary Groovy code through the Solr-based search functionality (GitHub Advisory).

The vulnerability is classified as a code injection vulnerability (CWE-94) and eval injection (CWE-95). It has received a CVSS v3.1 base score of 9.9 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The exploit involves creating a document with a specially crafted title containing malicious Groovy code that gets executed when the Solr space facet feature is used in the search interface (GitHub Advisory, NVD).

The vulnerability allows attackers to execute arbitrary Groovy code in the XWiki installation, compromising the confidentiality, integrity, and availability of the entire XWiki installation. This is particularly severe as it can be exploited by any user with default permissions, without requiring special privileges (GitHub Advisory).

The vulnerability can be exploited by creating a document with a title containing malicious code in the format '{{/html}}{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}'. When the search UI is used and the Location facet is deployed, the code is executed with system privileges (GitHub Advisory, XWIKI Jira).

The vulnerability has been patched in XWiki versions 14.10.20, 15.5.4, and 15.10 RC1. As a workaround for unpatched systems, administrators can manually modify the Main.SolrSpaceFacet page following the provided patch (GitHub Advisory).