CVE-2024-55879: XWiki Platform Remote Code Execution Flaw

CVE-2024-55879 Overview

CVE-2024-55879 is a missing authorization vulnerability [CWE-862] in the XWiki Platform, a generic open-source wiki platform. The flaw affects XWiki versions from 2.3 up to (but not including) 15.10.9 and 16.3.0. Any authenticated user holding script rights can perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. Successful exploitation compromises the confidentiality, integrity, and availability of the entire XWiki installation. The issue was patched in XWiki 15.10.9 and 16.3.0.

Critical Impact
Authenticated users with script rights can achieve remote code execution on the XWiki server, resulting in full compromise of the wiki platform and underlying data.

Affected Products

XWiki Platform versions 2.3 through 15.10.8
XWiki Platform versions 16.0.0 through 16.2.x
Component: xwiki-platform-administration (ConfigurableClass evaluation)

Discovery Timeline

2024-12-12 - CVE-2024-55879 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55879

Vulnerability Analysis

The vulnerability resides in how XWiki evaluates XWiki.ConfigurableClass instances used to render administration sections. XWiki treats content associated with configurable class instances as trusted, evaluating embedded Velocity or Groovy expressions in a privileged context. Because authorization checks are missing when instances of XWiki.ConfigurableClass are attached to arbitrary pages, any user holding script rights can inject and trigger evaluation of attacker-controlled scripts. The result is arbitrary code execution in the XWiki server process. This mirrors the categorization of missing authorization weaknesses tracked under [CWE-862].

Root Cause

The root cause is insufficient validation of the origin and authorization context of XWiki.ConfigurableClass objects. The administration UI evaluates configurable sections without verifying that the containing page carries the appropriate administrative privileges. Users with script rights, which are broader than administrative rights, can attach configurable class instances to pages they control and trigger privileged evaluation.

Attack Vector

The attack is network-based and requires low privileges. An authenticated user with script rights creates or edits a page and attaches an XWiki.ConfigurableClass object containing malicious script content. When the administration UI renders the configurable section, the platform evaluates the script with elevated privileges, giving the attacker command execution on the server. No user interaction beyond normal navigation is required to trigger the evaluation path.

text

// Security patch: xwiki-platform-core/xwiki-platform-administration/pom.xml
   <packaging>pom</packaging>
   <description>Application for administrating wiki features like users, groups, rights etc.</description>
   <modules>
+    <module>xwiki-platform-administration-api</module>
     <module>xwiki-platform-administration-ui</module>
   </modules>
   <profiles>

Source: XWiki Platform commit 8493435. The patch introduces a new xwiki-platform-administration-api module that centralizes and hardens the evaluation logic for ConfigurableClass, enforcing proper authorization before scripts execute.

Detection Methods for CVE-2024-55879

Indicators of Compromise

Newly created or modified pages containing XWiki.ConfigurableClass objects authored by non-administrative accounts.
Unexpected child processes spawned by the XWiki Java servlet container (for example sh, bash, cmd.exe, powershell.exe).
Outbound network connections initiated by the XWiki JVM to unfamiliar hosts shortly after page edits.
Anomalous writes to filesystem locations outside the XWiki data directory.

Detection Strategies

Audit the XWiki object store for XWiki.ConfigurableClass instances and correlate authors against the list of accounts that legitimately require script rights.
Review XWiki access and edit logs for save or objectadd actions targeting ConfigurableClass on non-administrative pages.
Instrument the JVM with process-monitoring telemetry to identify command execution originating from the wiki application server.

Monitoring Recommendations

Forward XWiki application logs, servlet container logs, and host process telemetry to a centralized analytics platform for correlation.
Alert on process-execution chains where the wiki JVM is the parent of shell interpreters or scripting utilities.
Track the population of users with script rights and generate alerts on grant changes.

How to Mitigate CVE-2024-55879

Immediate Actions Required

Upgrade XWiki Platform to version 15.10.9, 16.3.0, or later without delay.
Inventory accounts holding script rights and revoke the privilege where it is not strictly required.
Review recent edits to pages containing XWiki.ConfigurableClass objects and remove any unauthorized instances.

Patch Information

The vulnerability is fixed in XWiki 15.10.9 and 16.3.0. The fix is delivered in commit 8493435ff9606905a2d913607d6c79862d0c168d, which introduces a new xwiki-platform-administration-api module to improve the evaluation of ConfigurableClass. Refer to the GitHub Security Advisory GHSA-r279-47wg-chpr, the related GHSA-wh34-m772-5398, and the tracking issue XWIKI-21207.

Workarounds

No official workarounds are available according to the vendor advisory; upgrading is required.
As a compensating control, minimize the number of users with script rights and audit their activity closely until the patch is applied.
Restrict network egress from the XWiki server to reduce the impact of successful code execution.

bash

# Verify installed XWiki version before and after upgrade
curl -s https://<xwiki-host>/xwiki/bin/view/Main/ | grep -Eo 'XWiki [0-9]+\.[0-9]+\.[0-9]+'

# Example: list users with script rights via the XWiki admin console
# Navigate to: /xwiki/bin/view/XWiki/XWikiPreferences?editor=globaladmin§ion=Rights