.. / CVE-2024-21650

• RCE
• PoC
• Nuclei
• Web

Exploit for XWiki < 14.10.17, 15.5.3, 15.8-rc-1 - Unauthenticated Remote Code Execution (CVE-2024-21650)

Description:

XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the “first name” or “last name” fields during user registration. This impacts all installations that have user registration enabled for guests.

Affected Products:

• XWiki < 14.10.17
• XWiki < 15.5.3
• XWiki < 15.8-rc-1

Nuclei Template

View the template here CVE-2024-21650.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-21650.yaml

References: