XWiki Jetty Package File Access Vulnerability

A vulnerability in the XWiki Jetty package (XJetty) allows static access to any file in the webapp/ directory, including sensitive files that may contain credentials. This issue affects XWiki versions 16.7.0 prior to 16.10.11, 17.4.4, and 17.7.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive application files, such as configuration files that may contain credentials.

Reproduction

The vulnerability can be reproduced by deploying XWiki with the Jetty package using the default configuration. Once the application is running, files in the WEB-INF directory, such as xwiki.cfg, xwiki.properties, and hibernate.cfg.xml, can be accessed through the URL.

Remediation

Users can update to XWiki versions 16.10.11, 17.4.4, or 17.7.0 to address this vulnerability. For those using the Jetty package, it's recommended to modify the start_xwiki.sh script to set the JETTY_BASE variable to an absolute path, replacing the default relative path.