CVE-2025-49594

Executive Summary

CVE-2025-49594 is an improper access control vulnerability in the XWiki OIDC application, affecting versions 2.17.1 through 2.18.1. The flaw allows any authenticated user with VIEW access to a user profile to create an authentication token for that user. If the XWiki instance is configured to allow token-based authentication, this enables an attacker to impersonate any user whose profile is viewable—a condition that is almost always true for registered users. The vulnerability has a CVSS score of 0.0 (placeholder) but a real-world impact of high confidentiality and integrity compromise. No public exploit code or proof-of-concept is available at this time. The patch is available in version 2.18.2, which restricts token creation to users with admin rights on the target profile.

Supply Chain & Package Security

This vulnerability affects the XWiki OIDC extension, which is distributed via the XWiki Extension Manager and Maven Central. Organizations using XWiki with OIDC authentication should verify their extension version and update immediately. No malicious packages have been reported in the supply chain.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs only a valid user account with VIEW access.
• User Interaction (UI): None (N) – No user action is required for exploitation.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – An attacker can impersonate any user, gaining access to that user's data.
• Integrity (I): High (H) – An attacker can perform actions as the impersonated user, modifying data.
• Availability (A): None (N) – The vulnerability does not affect availability.

CVSS Score: 8.1 (High) – Based on the vector above.

Threat Level: High – The vulnerability allows privilege escalation and account takeover with minimal prerequisites.

Deep Dive & Mechanics

The XWiki OIDC extension provides tools for integrating OpenID Connect authentication into XWiki. The vulnerability resides in the token creation functionality. In affected versions, the code does not properly verify that the requesting user has administrative rights over the target user profile. Instead, it only checks that the requester has VIEW access to the profile. Since most user profiles are viewable by all registered users (or even anonymous users), this effectively allows any authenticated user to create a token for any other user.

The token, once created, can be used for authentication if the XWiki instance has token-based authentication enabled. This allows the attacker to bypass normal login procedures and assume the identity of the target user, including administrators.

The root cause is a missing authorization check in the token generation endpoint. The fix in version 2.18.2 adds a check that the requester has admin rights on the target user profile before allowing token creation.

Vulnerable vs. Patched Code

The vulnerable code (simplified) in the token creation endpoint:

// Vulnerable: Only checks VIEW access
if (hasViewAccess(currentUser, targetUser)) {
    String token = createToken(targetUser);
    return token;
} else {
    throw new AccessDeniedException();
}

The patched code in version 2.18.2:

// Patched: Checks admin access
if (hasAdminAccess(currentUser, targetUser)) {
    String token = createToken(targetUser);
    return token;
} else {
    throw new AccessDeniedException();
}

The change is minimal but critical: replacing hasViewAccess with hasAdminAccess ensures that only users with administrative privileges over the target profile can create tokens.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the target XWiki instance.
• The XWiki instance must have token-based authentication enabled.
• The target user's profile must be viewable (default for registered users).

Exploitation Steps:

1. Authenticate to the XWiki instance with your attacker account.
2. Identify a target user (e.g., an administrator) whose profile is viewable.
3. Send a POST request to the token creation endpoint with the target user's username:

   POST /xwiki/rest/oidc/token HTTP/1.1
   Host: target-xwiki.example.com
   Content-Type: application/json
   Authorization: Bearer <attacker_token>
   
   {
     "username": "admin"
   }
   

4. Receive the token in the response:

   {
     "token": "generated_token_here"
   }
   

5. Use the token to authenticate as the target user:

   GET /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome HTTP/1.1
   Host: target-xwiki.example.com
   Authorization: Bearer generated_token_here
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual token creation requests, especially from non-admin users.
• Alert on multiple token creation requests targeting different users from the same source.
• Review logs for authentication events using tokens that were not created by an admin.

Hunting:

• Search for API calls to /rest/oidc/token from users who are not administrators.
• Correlate token creation events with subsequent authentication events to identify potential impersonation.

Prevention:

• Apply the patch (upgrade to version 2.18.2) immediately.
• As a workaround, disable token-based authentication in XWiki configuration.
• Restrict VIEW access to user profiles to only trusted users.

Indicators of Compromise (IOCs)

• Network: POST requests to /rest/oidc/token with a JSON body containing a username field.
• Logs: XWiki audit logs showing token creation by a non-admin user.
• Authentication: Authentication events using tokens that were not created by an admin.
• User Behavior: Sudden privilege escalation or actions performed by a user that are inconsistent with their normal behavior.

Detection Engineering

YARA Rule

rule CVE_2025_49594_XWiki_OIDC_Token_Creation {
    meta:
        description = "Detects exploitation attempts of CVE-2025-49594 in XWiki OIDC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49594"
    strings:
        $token_endpoint = "/rest/oidc/token"
        $json_body = /{"username":\s*"[^"]+"}/
    condition:
        $token_endpoint and $json_body
}

Sigma Rule

title: XWiki OIDC Token Creation by Non-Admin User
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects token creation requests to XWiki OIDC endpoint from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: xwiki
detection:
    selection:
        http.method: POST
        http.url: /rest/oidc/token
        http.body: '{"username":*'
    filter:
        http.user_agent: 'XWiki-Admin-Bot'  # Example filter, adjust as needed
    condition: selection and not filter
falsepositives:
    - Legitimate admin token creation
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49594 XWiki OIDC Token Creation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/rest/oidc/token";
    http_uri;
    content:"{\"username\":";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade XWiki OIDC to version 2.18.2 or later.
2. Disable token-based authentication as a workaround if upgrade is not immediately possible.
3. Review user profiles for any unauthorized tokens that may have been created.

Long-Term Measures:

• Implement strict access controls on user profiles, limiting VIEW access to only necessary users.
• Enable audit logging for all token creation and authentication events.
• Regularly review and rotate authentication tokens.
• Monitor for unusual authentication patterns.

Valters IT Signature

This report is prepared by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.