Impact The query REST API allows executing HQL queries to filter the listed pages. While this properly checks access rights for the current user, the query can be used to combine when clauses and blind queries, to recover values, through FROM clause injection to join BaseObject and StringProperty tables, bypassing the HQL validator's SELECT column whitelist. This allows recovering any data that is stored in the database, including data from inaccessible pages, password hashes and passwords stored in configuration properties. For a typical password hash, this requires about 800 requests to the REST API (about one per bit). It should be assumed that when using more complex techniques, this even works when the attacker cannot read any wiki page. Password hashes use salted SHA1 in XWiki which can be cracked offline for weak passwords. Further, the executed database queries could be slow, affecting the availability of the system. ### Patches The vulnerability has been fixed in XWiki 16.10.18, 17.10.5 and 18.2.0 by disabling the HQL and WXQL queries in the REST API by default. ### Workarounds The requests to the "/rest/wikis/{wikiName}/query" endpoint could be blocked at the web server/reverse proxy level. ### References * https://jira.xwiki.org/browse/XWIKI-24061 * https://github.com/xwiki/xwiki-platform/commit/ae540bc3def0d4a30210eb9bead4e559984b4462