CVE-2024-31988: 
Java vulnerability analysis and mitigation

XWiki Platform, a generic wiki platform, contains a critical vulnerability (CVE-2024-31988) discovered in version 13.9-rc-1 and affecting versions prior to 4.10.19, 15.5.4, and 15.10-rc-1. The vulnerability exists in the realtime editor component and allows arbitrary remote code execution through admin user interaction (NVD, GitHub Advisory).

The vulnerability occurs when the realtime editor is installed in XWiki. An attacker can trigger code execution by getting an admin user with programming rights to either visit a crafted URL or view an image containing this URL in a comment. This allows the execution of arbitrary XWiki syntax, including scripting macros with Groovy or Python code. The vulnerability has received a CVSS v3.1 base score of 9.6 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) (GitHub Advisory).

The successful exploitation of this vulnerability compromises the confidentiality, integrity, and availability of the entire XWiki installation. An attacker can execute arbitrary code with admin privileges, potentially gaining full access to the system (GitHub Advisory).

The vulnerability can be exploited by crafting a specific URL or embedding it in an image within a comment. A proof of concept involves accessing a URL that executes Velocity code, which if successful, logs an error message demonstrating code execution capabilities (GitHub Advisory, XWIKI Jira).

The vulnerability has been patched in XWiki versions 14.10.19, 15.5.4, and 15.9. As a workaround, users can manually update RTFrontend.ConvertHTML with the security patch, though this may break some synchronization processes in the realtime editor. Upgrading is recommended for installations where the realtime editor is used (GitHub Advisory).