From 76ca4735f46ccef4cef2d6b046ff14d290a51feb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 31 Jul 2024 15:26:42 +0000
Subject: [PATCH] Publish GHSA-h63h-5c77-77p5

---
 .../GHSA-h63h-5c77-77p5.json                  | 120 ++++++++++++++++++
 1 file changed, 120 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-h63h-5c77-77p5/GHSA-h63h-5c77-77p5.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-h63h-5c77-77p5/GHSA-h63h-5c77-77p5.json b/advisories/github-reviewed/2024/07/GHSA-h63h-5c77-77p5/GHSA-h63h-5c77-77p5.json
new file mode 100644
index 00000000000..cd2ba5feba9
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-h63h-5c77-77p5/GHSA-h63h-5c77-77p5.json
@@ -0,0 +1,120 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h63h-5c77-77p5",
+  "modified": "2024-07-31T15:24:37Z",
+  "published": "2024-07-31T15:24:37Z",
+  "aliases": [
+    "CVE-2024-37901"
+  ],
+  "summary": "XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet",
+  "details": "### Impact\nAny user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on an instance, as a user without script nor programming rights, add an object of type `XWiki.SearchSuggestConfig` to your profile page, and an object of type `XWiki.SearchSuggestSourceClass` as well. On this last object, set both `name` and `icon` properties to `$services.logging.getLogger(\"attacker\").error(\"I got programming: $services.security.authorization.hasAccess('programming')\")` and `limit` and `engine` to `{{/html}}{{async}}{{velocity}}$services.logging.getLogger(\"attacker\").error(\"I got programming: $services.security.authorization.hasAccess('programming')\"){{/velocity}}{{/async}}`. Save and display the page. If the logs contain any message `ERROR attacker - I got programming: true` then the instance is vulnerable.\n\n### Patches\nThis vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.\n\n### Workarounds\nWe're not aware of any workaround except upgrading.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-21473\n- https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-search-ui"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.2-rc-1"
+            },
+            {
+              "fixed": "14.10.21"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-search-ui"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "15.0-rc-1"
+            },
+            {
+              "fixed": "15.5.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-search-ui"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "15.6-rc-1"
+            },
+            {
+              "fixed": "15.10.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/xwiki/xwiki-platform"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jira.xwiki.org/browse/XWIKI-21473"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862",
+      "CWE-95"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-31T15:24:37Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file