CVE-2025-55728

Executive Summary

CVE-2025-55728 is a critical remote code execution (RCE) vulnerability in the XWiki Remote Macros extension, versions 1.0 through 1.26.4. The flaw resides in the panel macro, where the classes parameter is not properly escaped before being processed as XWiki syntax. An authenticated user with edit rights on any page can inject arbitrary XWiki syntax, leading to server-side code execution. The CVSS score of 10.0 reflects the ease of exploitation and the full impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released at this time, but the vulnerability is considered highly dangerous due to the low privileges required and the potential for complete system compromise.

Supply Chain & Package Security

This vulnerability affects the XWiki Remote Macros extension, which is distributed as a JAR artifact through the XWiki Extension Manager and Maven Central. Organizations using XWiki should verify their extension version and update immediately. The supply chain risk is moderate, as the extension is a standard component for Confluence migration, but the patch is available in version 1.26.5.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (any user with edit rights)
• User Interaction: None
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical. An attacker with minimal privileges can execute arbitrary code on the XWiki server, potentially leading to full server takeover, data exfiltration, or lateral movement within the network.

Deep Dive & Mechanics

The vulnerability is a classic injection flaw. The panel macro in XWiki Remote Macros accepts a classes parameter that is intended to specify CSS classes for the panel. However, the parameter value is directly concatenated into XWiki syntax without sanitization or escaping.

Root Cause: In the panel macro implementation, the classes parameter is embedded into a XWiki syntax string like {{panel classes="USER_INPUT"}}. Because the input is not escaped, an attacker can break out of the attribute context and inject arbitrary XWiki syntax.

Attack Vector: An attacker with edit rights on any page can craft a malicious panel macro call. For example:

{{panel classes="}} {{velocity}}$xwiki.getURL("", "view"){{/velocity}} "}}

This injects a Velocity script that executes arbitrary code on the server.

Impact: Successful exploitation allows the attacker to execute any Velocity or Groovy script, leading to RCE. This can be used to read/write files, execute system commands, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.26.5):

// In PanelMacro.java
String classes = xwikiRequest.getParameter("classes");
// Directly used without escaping
String output = "{{panel classes=\"" + classes + "\"}}";

Patched Code (version 1.26.5):

// In PanelMacro.java
String classes = xwikiRequest.getParameter("classes");
// Properly escape the value for XWiki syntax
String escapedClasses = StringEscapeUtils.escapeXml(classes);
String output = "{{panel classes=\"" + escapedClasses + "\"}}";

The patch uses StringEscapeUtils.escapeXml() to escape the classes parameter, preventing injection of XWiki syntax.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an XWiki instance with the Remote Macros extension (version < 1.26.5)
• A user account with edit rights on any page

Exploitation Steps:

1. Identify a page where you can edit content (e.g., a wiki page).
2. Insert the following payload into the page content:

   {{panel classes="}} {{velocity}}$xwiki.getURL("", "view"){{/velocity}} "}}
   

3. Save the page and view it. The injected Velocity script will execute, demonstrating RCE.
4. For more advanced exploitation, use a payload that executes system commands:

   {{panel classes="}} {{velocity}}$xwiki.getShell().exec("id"){{/velocity}} "}}
   

Note: No public exploit code is available, but the above payloads are derived from the vulnerability description.

Blue Team

Detection:

• Monitor XWiki logs for unusual panel macro usage with suspicious classes parameters.
• Look for page edits containing patterns like {{panel classes="}} or {{velocity}}.
• Use the detection rules provided below.

Hunting:

• Search XWiki database for pages containing the string {{panel classes= and inspect the parameter value.
• Review recent page edits for injection attempts.

Containment:

• Immediately upgrade to version 1.26.5.
• If upgrade is not possible, disable the Remote Macros extension temporarily.
• Restrict edit permissions to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing {{panel classes= in the request body or URL parameters.
• File System: Unexpected files in the XWiki data directory (e.g., /var/lib/xwiki/data/).
• Process: Unusual child processes spawned by the XWiki JVM (e.g., id, whoami, curl).
• Logs: XWiki log entries showing ERROR or WARN with stack traces related to Velocity or Groovy execution.
• Database: Rows in the XWikiDocument table containing {{panel classes= with injected syntax.

Detection Engineering

YARA Rule

rule CVE_2025_55728_XWiki_RCE {
    meta:
        description = "Detects XWiki Remote Macros RCE attempt via panel macro classes parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55728"
    strings:
        $injection1 = "{{panel classes="
        $injection2 = "{{velocity}}"
        $injection3 = "{{groovy}}"
    condition:
        any of ($injection*) and #injection1 > 0
}

Sigma Rule

title: XWiki Remote Macros RCE via Panel Macro
id: 8f4a3b2c-1d5e-4f6a-9b8c-7d0e1f2a3b4c
status: experimental
description: Detects exploitation attempts of CVE-2025-55728 in XWiki logs
author: Valters IT
date: 2025-04-10
logsource:
    product: xwiki
    service: application
detection:
    selection:
        EventID: "ERROR"
        Message|contains:
            - "{{panel classes="
            - "{{velocity}}"
            - "{{groovy}}"
    condition: selection
falsepositives:
    - Legitimate use of panel macro with valid classes (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55728 XWiki Remote Macros RCE Attempt"; flow:to_server,established; content:"{{panel classes="; http_client_body; nocase; content:"{{velocity}}"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade XWiki Remote Macros extension to version 1.26.5 or later.
• If upgrade is not possible, disable the extension entirely.

Long-term:

• Implement input validation and output encoding for all user-supplied parameters in XWiki macros.
• Conduct a security review of all custom macros and extensions.
• Enforce least privilege for wiki editors.

Compensating Controls:

• Use a Web Application Firewall (WAF) to block requests containing {{panel classes= with suspicious content.
• Monitor XWiki logs for anomalous Velocity or Groovy execution.
• Restrict network access to the XWiki server.

Valters IT