CVE-2025-65036

Executive Summary

CVE-2025-65036 is a critical vulnerability in the XWiki Remote Macros extension, which provides rendering macros useful for migrating content from Confluence. The vulnerability allows an authenticated attacker to execute arbitrary Velocity code on the server by exploiting a missing permission check on the details pages. This can lead to full remote code execution (RCE), compromising the confidentiality, integrity, and availability of the XWiki instance. The vulnerability affects versions prior to 1.27.1. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the ease of exploitation and the potential impact.

Supply Chain & Package Security

This vulnerability affects the XWiki Remote Macros extension, which is distributed as a JAR file and can be installed via the XWiki Extension Manager. The extension is not available on NPM, PyPI, Go, or Ruby registries. The supply chain risk is moderate, as the extension is a third-party component that can be installed from the XWiki Extension Repository. Users should verify the integrity of the extension by checking its checksum and ensuring it is obtained from a trusted source.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – An attacker needs a valid user account with access to the details pages.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is easy to exploit and can lead to complete server compromise.

Deep Dive & Mechanics

The XWiki Remote Macros extension provides macros that are used when migrating content from Confluence. These macros include a details page that renders Velocity code. The vulnerability exists because the macro executes Velocity from the details pages without checking for proper permissions. An authenticated attacker can craft a malicious request to the details page, injecting arbitrary Velocity code that will be executed by the server.

The root cause is a missing permission check in the macro's rendering logic. The code does not verify that the user has the right to execute Velocity code before processing the request. This allows any authenticated user to execute arbitrary Velocity scripts, which can be used to read/write files, execute system commands, or access sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.27.1):

// In the macro rendering code, no permission check is performed
public class RemoteMacro {
    public String renderDetails(String macroContent) {
        // Directly executes Velocity without checking permissions
        return velocityEngine.evaluate(macroContent);
    }
}

Patched Code (1.27.1):

// In the patched version, a permission check is added
public class RemoteMacro {
    public String renderDetails(String macroContent, XWikiContext context) {
        // Check if the user has the right to execute Velocity
        if (!context.getWiki().getRightService().hasAccessLevel("programming", context.getDoc().getAuthor(), context.getDoc(), context)) {
            throw new AccessDeniedException("You do not have permission to execute Velocity code.");
        }
        return velocityEngine.evaluate(macroContent);
    }
}

The patch adds a permission check using hasAccessLevel("programming", ...) to ensure that only users with the programming right can execute Velocity code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the XWiki instance.
• Access to a page that uses the Remote Macros extension.

Exploitation Steps:

1. Identify a page that uses the Remote Macros extension.
2. Craft a malicious request to the details page with Velocity code injection.
3. Execute the request to achieve remote code execution.

Example Payload:

#set($cmd = "whoami")
#set($result = $services.scripting.evaluate("velocity", "#set($proc = $xwiki.getXWiki().getRuntime().exec('$cmd'))"))
$result

Lab Setup:

• Install XWiki with the Remote Macros extension version < 1.27.1.
• Create a user account with edit rights.
• Create a page that uses the Remote Macros macro.
• Use a tool like Burp Suite or curl to send the malicious request.

Blue Team

Detection:

• Monitor for unusual Velocity code execution in XWiki logs.
• Look for requests to the details page with suspicious parameters.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to version 1.27.1 or later.
• If upgrading is not possible, restrict access to the details pages to trusted users only.
• Implement Web Application Firewall (WAF) rules to block Velocity code injection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /xwiki/bin/view/RemoteMacros/Details with unusual parameters.
  • HTTP POST requests containing Velocity code in the request body.
• File IOCs:
  • Unexpected files created in the XWiki data directory.
  • Modified configuration files.
• Log IOCs:
  • XWiki logs showing Velocity execution errors or warnings.
  • Access logs showing repeated attempts to access the details page.

Detection Engineering

YARA Rule

rule CVE_2025_65036_XWiki_RCE {
    meta:
        description = "Detects Velocity code injection attempts targeting CVE-2025-65036"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-65036"
    strings:
        $velocity_injection = /#set\(\$cmd\s*=\s*"[^"]*"\)/
        $velocity_exec = /#set\(\$result\s*=\s*\$services\.scripting\.evaluate\("velocity"/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-65036 XWiki Remote Macros RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-65036 via Velocity code injection
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: xwiki
detection:
    selection:
        cs-uri-query|contains: "/xwiki/bin/view/RemoteMacros/Details"
        cs-method: "POST"
        cs-uri-query|contains: "velocity"
    condition: selection
falsepositives:
    - Legitimate use of Velocity in macros by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65036 XWiki Remote Macros RCE"; flow:to_server,established; content:"POST"; http_method; content:"/xwiki/bin/view/RemoteMacros/Details"; http_uri; content:"velocity"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the XWiki Remote Macros extension to version 1.27.1 or later.
2. If upgrading is not possible, disable the Remote Macros extension until a patch can be applied.
3. Review user permissions and ensure that only trusted users have access to the details pages.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to block Velocity code injection attempts.
• Regularly update all XWiki extensions and core components.
• Conduct security audits of custom macros and extensions.
• Monitor XWiki logs for suspicious activity.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valters.it