CVE-2025-66473

Executive Summary

CVE-2025-66473 is a Denial of Service (DoS) vulnerability in the XWiki REST API. The vulnerability arises because the REST API does not enforce any limits on the number of items that can be requested in a single API call. An unauthenticated attacker can exploit this by requesting a resource that returns all pages or spaces in the wiki, such as /rest/wikis/xwiki/spaces. Depending on the number of pages and the server's memory configuration, this can cause excessive resource consumption, leading to slowness or complete unavailability of the wiki service. The vulnerability affects XWiki versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0. Patches are available in versions 16.10.11 and 17.4.4.

Supply Chain & Package Security

XWiki is a Java-based open-source wiki platform. The vulnerability is in the core REST API module, which is a standard component of the XWiki distribution. There is no indication of a compromised package or malicious dependency. The fix is applied by upgrading to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low
• Threat Level: Medium (DoS only, no data breach)

Deep Dive & Mechanics

The vulnerability is a classic resource exhaustion issue. The XWiki REST API endpoints, such as /rest/wikis/{wikiName}/spaces, are designed to return a list of all spaces (or pages) in the wiki. In vulnerable versions, there is no pagination, limit, or throttling mechanism implemented. An attacker can send a single HTTP GET request to this endpoint, and the server will attempt to load all spaces from the database into memory and serialize them into the response.

If the wiki contains a large number of pages (e.g., hundreds of thousands), this operation can consume significant CPU and memory resources. The server may become unresponsive or crash, resulting in a Denial of Service for legitimate users.

The vulnerability is exploitable without authentication because the REST API endpoints are publicly accessible by default. The attack does not require any special privileges or user interaction.

Vulnerable vs. Patched Code

The fix involves adding pagination and/or a maximum limit to the REST API endpoints. The following is a conceptual comparison.

Vulnerable Code (Conceptual - Java):

@GET
@Path("/spaces")
public Response getAllSpaces() {
    List<Space> spaces = spaceService.getAllSpaces(); // No limit
    return Response.ok(spaces).build();
}

Patched Code (Conceptual - Java):

@GET
@Path("/spaces")
public Response getAllSpaces(@QueryParam("limit") @DefaultValue("100") int limit,
                             @QueryParam("offset") @DefaultValue("0") int offset) {
    List<Space> spaces = spaceService.getSpaces(limit, offset); // Paginated
    return Response.ok(spaces).build();
}

The patched version introduces limit and offset query parameters to enforce pagination, preventing the server from loading all records at once.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Reconnaissance: Identify XWiki instances using Shodan or similar. Look for endpoints like /rest/wikis/xwiki/spaces.

2. Exploitation: Send a GET request to the vulnerable endpoint without any pagination parameters.

   curl -v "http://target-xwiki.com/rest/wikis/xwiki/spaces"
   

3. Denial of Service: If the wiki has a large number of pages, the server will become slow or unresponsive. For a more aggressive attack, send multiple concurrent requests.

   for i in {1..100}; do
     curl -s "http://target-xwiki.com/rest/wikis/xwiki/spaces" > /dev/null &
   done
   wait
   

Blue Team (Defense & Detection)

1. Monitor REST API Endpoints: Look for requests to /rest/wikis/*/spaces or similar endpoints that return large datasets.
2. Rate Limiting: Implement rate limiting on the REST API to prevent abuse.
3. Resource Monitoring: Monitor server CPU and memory usage for spikes.
4. Web Application Firewall (WAF): Create rules to block requests to the vulnerable endpoint without pagination parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /rest/wikis/*/spaces without limit or offset parameters.
  • High volume of requests to REST API endpoints from a single IP address.
• System IOCs:
  • High CPU and memory usage on the XWiki server.
  • Application logs showing slow response times or out-of-memory errors.
  • Application crashes or unavailability.

Detection Engineering

YARA Rule

rule Detect_XWiki_DoS_Exploit {
    meta:
        description = "Detects HTTP requests targeting the XWiki REST API without pagination"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "N/A"
    strings:
        $rest_path = "/rest/wikis/"
        $spaces = "/spaces"
        $no_limit = "limit="
    condition:
        $rest_path at 0 and $spaces and not $no_limit
}

Sigma Rule

title: XWiki REST API DoS Exploitation Attempt
id: xwiki-rest-dos
status: experimental
description: Detects attempts to exploit CVE-2025-66473 by requesting the /rest/wikis/*/spaces endpoint without pagination.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem|contains: "/rest/wikis/"
        cs-uri-stem|contains: "/spaces"
        cs-uri-query|contains: "limit="
    condition: selection and not cs-uri-query|contains: "limit="
falsepositives:
    - Legitimate requests with very large limit values (e.g., limit=10000)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"XWiki REST API DoS Exploit (CVE-2025-66473)";
    flow:to_server,established;
    content:"/rest/wikis/"; http_uri;
    content:"/spaces"; http_uri;
    pcre:"/^\/rest\/wikis\/[^\/]+\/spaces$/U";
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Upgrade XWiki to version 16.10.11 or 17.4.4 (or later).
2. Workaround: If immediate upgrade is not possible, implement a reverse proxy (e.g., Nginx) to rate-limit requests to the REST API.

   limit_req_zone $binary_remote_addr zone=xwiki_rest:10m rate=5r/s;
   server {
       location /rest/ {
           limit_req zone=xwiki_rest burst=10 nodelay;
           proxy_pass http://xwiki_backend;
       }
   }
   

3. Long-term: Ensure all REST API endpoints implement pagination and input validation.

Valters IT