Eval Injection Affecting org.xwiki.platform:xwiki-platform-search-ui package, versions [,14.10.20) [15.0-rc-1,15.5.4) [15.6-rc-1,15.10-rc-1)

org.xwiki.platform:xwiki-platform-search-ui is a Platform Search UI which allows searching on the full wiki using wildcards, searching by space, getting search result RSS feeds and more. By default provides a Database-backed search but allows pluging other engines (such as Lucene, Solr and more)

Affected versions of this package are vulnerable to Eval Injection via the database search functionality. An attacker can execute arbitrary code on the server by injecting malicious code into search text. This vulnerability is exploitable by any visitor to a public wiki or a user of a closed wiki, as the database search is accessible by default to all users. This impacts the confidentiality, integrity, and availability of the entire XWiki installation.

This vulnerability can be mitigated by manually applying the patch to the Main.DatabaseSearch page. Alternatively, the database search page can be deleted as it is not the default search interface of XWiki.

<hostname>/xwiki/bin/get/Main/DatabaseSearch?outputSyntax=plain&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello%20from%22%20%2B%20%22%20search%20text%3A%22%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Vulnerable Code
• XWiki Jira
• Nuclei Templates