CyberRota Analysis
AI-GeneratedThe XWiki Platform is vulnerable due to a flaw in the /skin/ action that allows unauthenticated remote attackers to exploit double-encoded parent-directory segments, potentially gaining access to sensitive resources like configuration files and host files. This vulnerability poses a high risk, especially for deployments using Jetty 12 or later, and should be prioritized by organizations using affected versions prior to 17.10.5 and 18.2.0. Immediate patching is recommended to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.