CVE-2025-55727

Executive Summary

CVE-2025-55727 is a critical remote code execution (RCE) vulnerability in the XWiki Remote Macros extension, versions 1.0 through 1.26.4. The flaw resides in the column macro, where the width parameter is not properly escaped before being rendered in XWiki syntax. This allows an attacker with the ability to edit any page (or access the CKEditor converter) to inject arbitrary XWiki syntax, leading to RCE. The vulnerability is particularly dangerous because it can be exploited by any authenticated user with edit rights, and the impact is total compromise of the XWiki instance.

Supply Chain & Package Security

This vulnerability affects the XWiki Remote Macros extension, which is distributed as a Maven artifact (org.xwiki.contrib:xwiki-remote-macros). Users who install this extension via the XWiki Extension Manager or manually deploy the JAR file are affected. The supply chain risk is moderate, as the extension is not a core XWiki component but is widely used for Confluence migration. The patch is available in version 1.26.5, and users should update immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - requires edit rights on any page
• User Interaction: None (UI:N)
• Scope: Changed (S:C) - the vulnerable component is different from the impacted component
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The high score reflects the ease of exploitation and the severe impact, including full system compromise.

Deep Dive & Mechanics

The XWiki Remote Macros extension provides macros for migrating content from Confluence. The column macro ({{column}}) accepts a width parameter to set the column width. In vulnerable versions, this parameter is directly embedded into the XWiki syntax without escaping.

The vulnerable code (simplified) looks like:

// Vulnerable: width parameter is not escaped
String output = "{{column width=\"" + width + "\"}}";

An attacker can inject XWiki syntax by providing a malicious width value. For example:

{{column width="1"}}{{groovy}}println("RCE"){{/groovy}}{{/column}}

This injection allows the attacker to execute arbitrary Groovy or Velocity code, which runs with the privileges of the wiki admin (if the macro was installed by a user with programming rights) or with the privileges of the wiki admin (if the macro is installed by a user with programming rights). The injected code can read, modify, or delete any data, execute system commands, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.26.5):

// In ColumnMacro.java
public String render(String width, ...) {
    // No escaping of width
    return "{{column width=\"" + width + "\"}}";
}

Patched Code (version 1.26.5):

// In ColumnMacro.java
public String render(String width, ...) {
    // Properly escape the width parameter
    String escapedWidth = StringEscapeUtils.escapeXml(width);
    return "{{column width=\"" + escapedWidth + "\"}}";
}

The patch uses StringEscapeUtils.escapeXml() to escape the width parameter, preventing XWiki syntax injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an XWiki instance with the Remote Macros extension installed (version < 1.26.5)
• A valid user account with edit rights on any page

Exploit Steps:

1. Create or edit a page that uses the column macro.
2. Inject malicious XWiki syntax in the width parameter:

   {{column width="1"}}{{groovy}}println("RCE"){{/groovy}}{{/column}}
   

3. Save the page. The injected Groovy code will execute when the page is rendered.

Example Payloads:

• Execute system command:

  {{column width="1"}}{{groovy}}Runtime.getRuntime().exec("id"){{/groovy}}{{/column}}
  

• Read sensitive file:

  {{column width="1"}}{{groovy}}new File("/etc/passwd").text{{/groovy}}{{/column}}
  

Note: If the macro was installed by a user without programming rights, the injected code will run with the privileges of the wiki admin, which may still allow significant damage.

Blue Team

Detection:

• Monitor for unusual width parameter values in page edits, especially those containing XWiki syntax like {{groovy}}, {{velocity}}, or {{script}}.
• Look for pages that contain the column macro with suspiciously long or complex width values.
• Check for unexpected Groovy or Velocity script execution in XWiki logs.

Hunting:

• Search XWiki database for pages containing {{column width= followed by XWiki syntax.
• Review XWiki logs for errors related to macro rendering or script execution.

Lab Setup:

1. Deploy a vulnerable XWiki instance (e.g., using Docker):

   docker run -d -p 8080:8080 --name xwiki-vuln xwiki:15.10
   

2. Install the vulnerable Remote Macros extension (version 1.26.4 or earlier) via the Extension Manager.
3. Create a test user with edit rights.
4. Reproduce the exploit by editing a page with the malicious width parameter.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to XWiki pages containing {{column width= with embedded XWiki syntax.
  • Outbound connections from the XWiki server to external IPs (if the attacker uses reverse shell or data exfiltration).

• Host:

  • Unusual processes spawned by the XWiki JVM (e.g., id, curl, nc).
  • New files created in the XWiki data directory or temporary directories.
  • Modified XWiki configuration files.

• Logs:

  • XWiki logs containing Groovy or Velocity script execution errors.
  • Web server logs showing requests with suspicious width parameters.

Detection Engineering

YARA Rule

rule CVE_2025_55727_XWiki_RCE {
    meta:
        description = "Detects XWiki Remote Macros RCE via column macro width parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55727"
        severity = "critical"
    strings:
        $s1 = "{{column width=" ascii
        $s2 = "{{groovy}}" ascii
        $s3 = "{{velocity}}" ascii
        $s4 = "{{script}}" ascii
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2025-55727 XWiki Remote Macros RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-55727 via column macro width parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '{{column width='
    condition: selection
falsepositives:
    - Legitimate use of column macro with normal width values
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55727 XWiki Remote Macros RCE"; flow:to_server,established; content:"{{column width="; http_uri; content:"{{groovy}}"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the XWiki Remote Macros extension to version 1.26.5 or later.
2. If upgrade is not possible, disable the Remote Macros extension temporarily.
3. Restrict edit rights to trusted users only.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block requests containing {{column width= followed by XWiki syntax.
• Monitor XWiki logs for unusual macro rendering activity.
• Conduct regular security audits of XWiki extensions.

Workaround:

• If the extension cannot be upgraded, manually patch the ColumnMacro.java file to escape the width parameter using StringEscapeUtils.escapeXml().

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.