CVE-2023-48292

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.

• CWE-352

• https://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8Patch
• https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9Patch, Vendor Advisory
• https://jira.xwiki.org/browse/ADMINTOOL-91Issue Tracking, Vendor Advisory
• https://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8Patch
• https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9Patch, Vendor Advisory
• https://jira.xwiki.org/browse/ADMINTOOL-91Issue Tracking, Vendor Advisory

Published

Nov 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48287Missing Authorization vulnerability in Matat Technologies Te…5.4
• CVE-2023-48288Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2023-48289Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-4829Cross-site Scripting (XSS) - Stored in GitHub repository fro…5.4
• CVE-2023-48290Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-48291Apache Airflow, in versions prior to 2.8.0, contains a secur…4.3
• CVE-2023-48293The XWiki Admin Tools Application provides tools to help the…8.8
• CVE-2023-48294LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…4.3
• CVE-2023-48295LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.4
• CVE-2023-48296OroPlatform is a PHP Business Application Platform (BAP). N…4.3
• CVE-2023-48297Discourse is a platform for community discussion. The messag…7.5
• CVE-2023-48298ClickHouse® is an open-source column-oriented database manag…7.5