CVE-2024-31984: XWiki Platform RCE Vulnerability

CVE-2024-31984 Overview

CVE-2024-31984 is a code injection vulnerability in the XWiki Platform, a generic Java-based wiki platform. The flaw exists in the Solr-based search functionality, specifically in the Main.SolrSpaceFacet page. An attacker who can edit the title of a space (all users by default in a standard XWiki installation) can craft a specially formed document title that triggers Groovy code execution during search rendering. Successful exploitation compromises the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability affects versions starting at 7.2-rc-1 and prior to 14.10.20, 15.5.4, and 15.10-rc-1.

Critical Impact
Any authenticated user with edit access to space titles can execute arbitrary Groovy code on the XWiki server, resulting in full remote code execution.

Affected Products

XWiki Platform versions 7.2-rc-1 through 14.10.19
XWiki Platform 15.0 through 15.5.3
XWiki Platform 15.6 through 15.9

Discovery Timeline

2024-04-10 - CVE-2024-31984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31984

Vulnerability Analysis

The vulnerability is a code injection flaw [CWE-94, CWE-95] in the Main.SolrSpaceFacet XWiki page. This page renders space facet hierarchy data used by the Solr-based search interface. The rendering logic inserts the plain title of a space document into the output without escaping. Because XWiki processes Velocity and Groovy directives in rendered content, an attacker can embed a Groovy script inside a space title. When any user triggers a search that renders the space facet, the malicious title is evaluated server-side.

Exploitation requires only a low-privileged authenticated account. In default XWiki installations, all registered users can create or edit spaces, which makes the attack surface broad. The executed Groovy code runs with the privileges of the XWiki application, granting the attacker access to configuration, credentials, and stored wiki data.

Root Cause

The root cause is missing output escaping in the SolrSpaceFacet.xml template. The template referenced $spaceDocument.plainTitle and $spaceReference.name directly, allowing embedded scripting syntax to be interpreted by the XWiki rendering engine instead of being treated as literal text.

Attack Vector

An authenticated attacker creates or renames a space with a title containing crafted Groovy syntax. When any user, including the attacker, uses the Solr search interface that renders space facets, the malicious title is parsed and executed by the XWiki rendering pipeline. No user interaction beyond a normal search request is required to trigger execution.

text

// Vulnerable template (before patch)
#set ($spaceReference = $services.model.resolveSpace($localSpaceReference))
#set ($spaceDocument = $xwiki.getDocument($spaceReference))
#if ($spaceDocument)
  $spaceDocument.plainTitle
#else
  $spaceReference.name
#end

// Source: https://github.com/xwiki/xwiki-platform/commit/43c9d551e3c11e9d8f176b556dd33bbe31fc66e0

Detection Methods for CVE-2024-31984

Indicators of Compromise

Space documents with titles containing Velocity (#, $), Groovy, or XML/HTML markup syntax.
Unexpected groovy script execution entries or Java reflection calls in XWiki application logs.
New or modified administrator accounts, wiki pages, or scheduled jobs created shortly after search activity.
Outbound network connections initiated by the XWiki JVM process to unfamiliar hosts.

Detection Strategies

Audit all XWiki.XWikiSpaceClass documents and space titles for scripting characters or template directives.
Review Solr query logs and correlate search requests with subsequent process spawns from the application server.
Monitor XWiki server logs for stack traces referencing GroovyScriptEngine or unexpected ScriptEvaluationException events.
Compare deployed Main.SolrSpaceFacet page content against the patched version referenced in GHSA-xm4h-3jxr-m3c6.

Monitoring Recommendations

Enable verbose auditing of space create and rename events in XWiki.
Alert on child processes spawned by the XWiki servlet container (Tomcat, Jetty) such as sh, bash, curl, or wget.
Track file writes into the XWiki data directory and permanent directory by non-administrative users.

How to Mitigate CVE-2024-31984

Immediate Actions Required

Upgrade XWiki Platform to version 14.10.20, 15.5.4, 15.10-rc-1, or later without delay.
Inventory existing space titles and remove any containing Velocity, Groovy, or XML-escaped scripting syntax.
Restrict space creation and edit permissions to trusted users until the patch is applied.
Rotate credentials and API keys stored on the XWiki server if compromise is suspected.

Patch Information

The fix escapes user-controlled title data before rendering in the Solr space facet template. The patched template applies $escapetool.xml to both $spaceDocument.plainTitle and $spaceReference.name, preventing embedded scripting syntax from being evaluated. See the upstream commit for reference.