CVE-2024-37899: XWiki Platform RCE Vulnerability

CVE-2024-37899 Overview

CVE-2024-37899 is a code injection vulnerability [CWE-94] in XWiki Platform, an open-source generic wiki platform. The flaw allows a low-privileged user to execute arbitrary Groovy code with administrator rights by embedding malicious script content in their user profile. When an administrator disables the offending user account, the platform renders the user profile using the admin's authorship context, triggering execution of attacker-controlled code.

Critical Impact
An authenticated user without script or programming rights can achieve remote code execution as an administrator, leading to full compromise of the XWiki instance.

Affected Products

XWiki Platform versions prior to 14.10.21
XWiki Platform 15.x versions prior to 15.5.5 and 15.10.6
XWiki Platform 16.0.0 release candidates prior to the stable 16.0.0 release

Discovery Timeline

2024-06-20 - CVE-2024-37899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37899

Vulnerability Analysis

The vulnerability resides in the account disable/enable workflow of XWiki. When an administrator clicks the "Disable this account" button on a user profile, the underlying save operation is performed in the administrator's authorship context. XWiki uses document authorship to determine whether embedded scripts (such as Groovy or Velocity macros) may execute. Because the disable action changes the document's last author to the admin, subsequent renders of that profile evaluate embedded scripts with the admin's programming rights.

A user without script or programming rights can plant a payload such as {{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}} in the About section of their profile. Once the admin disables the account and the profile is reloaded, the Groovy block executes under admin privileges. This grants the attacker arbitrary code execution on the server.

Root Cause

The root cause is improper author assignment during account state changes. The save operation invoked by the disable action inherited the admin's identity as the effective author of the user profile document, rather than preserving the original low-privileged author. XWiki's script execution model trusts the last author's rights, so the Groovy macro was granted programming rights it should never have received.

Attack Vector

Exploitation requires an authenticated user account and social interaction from an administrator. The attacker edits their own profile to include Groovy or Velocity script macros, then engages in behavior likely to prompt the admin to disable the account. Upon disabling, the malicious script executes server-side with elevated rights.

java

 import org.xwiki.model.reference.EntityReferenceSerializer;
 import org.xwiki.model.reference.LocalDocumentReference;
 import org.xwiki.model.reference.WikiReference;
+import org.xwiki.user.UserReference;
+import org.xwiki.user.UserReferenceResolver;
 
 import com.xpn.xwiki.XWiki;
 import com.xpn.xwiki.XWikiContext;

Source: XWiki security patch commit f89c8f4 — the patch modifies XWikiUser.java to resolve and set the correct author reference when toggling account state.

Detection Methods for CVE-2024-37899

Indicators of Compromise

Log entries showing unexpected Groovy or Velocity output such as attacker - Hello from Groovy! or unfamiliar logger names originating from user profile renders.
User profile documents (in the XWiki space) containing {{groovy}}, {{velocity}}, or {{python}} macro blocks authored by non-admin users.
Recent account disable actions immediately followed by anomalous server-side process execution or outbound network connections.

Detection Strategies

Query the XWiki document store for user profile pages whose content contains script macros; these should not exist for users without programming rights.
Audit the XWikiUsers object revision history for profile edits made shortly before account disable events.
Correlate administrator disable actions with process creation, file writes, or DNS queries originating from the XWiki JVM process.

Monitoring Recommendations

Enable and centralize XWiki application logs, especially entries from org.xwiki and custom loggers, for anomaly review.
Monitor the JVM process hosting XWiki for spawned child processes, unexpected outbound connections, and file system writes outside the data directory.
Alert on modifications to any document under the XWiki user space where the last author differs from the document owner.

How to Mitigate CVE-2024-37899

Immediate Actions Required

Upgrade XWiki Platform to a patched version: 14.10.21, 15.5.5, 15.10.6, or 16.0.0 or later.
Before disabling any suspicious user account, review the profile content for script macros and remove them using a trusted admin account with content editing controls.
Audit existing user profiles across the wiki for embedded {{groovy}}, {{velocity}}, and {{python}} macro blocks and remediate any found.

Patch Information

The fix is committed in f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a and released in XWiki 14.10.21, 15.5.5, 15.10.6, and 16.0.0. The patch updates XWikiUser.java to explicitly set the correct author when the account state is changed, and refactors getusers.vm so that disable and enable actions are routed through XWiki.XWikiUserProfileSheet with an explicit action parameter rather than a direct document save. Refer to the GitHub Security Advisory GHSA-j584-j2vj-3f93 and XWiki Jira issue XWIKI-21611 for full details.

Workarounds

No workarounds exist; the XWiki project states upgrading is the only remediation.
As a temporary compensating control, administrators can inspect a user's profile source for script macros before invoking the disable action.

bash

# Verify installed XWiki version and confirm it meets the patched baseline
curl -s https://<xwiki-host>/xwiki/bin/view/Main/ | grep -i "xwiki.*version"

# Grep the XWiki database export for suspicious macros in user profiles
grep -RiE "\{\{(groovy|velocity|python)\}\}" /path/to/xwiki/data/pages/XWiki/