Skip to content
Fencer Vulns
critical 9.7

CVE-2023-48292 in the critical feed json

XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

published 2023-11-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-8jpr-ff92-hpf9 , EUVD-2023-2925

cvss
9.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
22.9%
EPSS 22.9% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.

Patch / fix

  • maven org.xwiki.contrib:xwiki-application-admintools 4.5.1
  • xwiki admin_tools 4.5.1

Timeline

  1. Published
  2. First public exploit (EDB-52105)

Exploit prediction

22.94% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52105 XWiki Standard 14.10 - Remote Code Execution (RCE) webapps, 2025-03-29

CVSS scores

assigned by version score vector
CNA 3.1 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.xwiki.contrib:xwiki-application-admintools
>=4.4, <4.5.1
4.5.1

Affected products

  • xwiki-contrib application-admintools

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.