XWiki Remote Macros Velocity Execution Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability exists in XWiki Remote Macros versions through 1.27.0. The issue arises because the macro executes Velocity scripts from details pages without proper permission checks. This flaw can be exploited by users without programming rights.

Impact

Exploitation allows for remote code execution on the server where XWiki is hosted.

Reproduction

To reproduce this vulnerability, a user without programming rights can create a new page and insert a details macro with an asynchronous macro call that includes Groovy code. After saving the page, an admin can add the details summary macro to another page, ensuring to include the correct CQL parameter to reference the page containing the injected code.

Remediation

Users can update to XWiki Remote Macros version 1.27.1 or later, where this vulnerability has been patched.