EUVD-2025-18293
GHSA-c32m-27pj-4xcj
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.
Analysis
XWiki's macro rights analyzer introduced in version 15.9RC1 contains incomplete validation that allows attackers to hide malicious script macros (Groovy, Python) by exploiting non-lowercase parameter handling and unanalyzed macro parameters. An authenticated attacker with limited privileges can inject hidden malicious macros that execute when a higher-privileged user edits the page, enabling remote code execution. This vulnerability affects XWiki versions 15.9RC1 through 16.4.6, 16.10.0-16.10.2, and 16.x-17.0.0-rc1, with patches available in versions 16.4.7, 16.10.3, and 17.0.0.
Technical Context
XWiki is a Java-based wiki platform that supports dynamic macro execution including dangerous macros (script, Groovy, Python) that require programming rights. The vulnerability stems from incomplete implementation of CWE-357 (Insufficient UI Warning of Dangerous Operations), specifically in the rights analyzer components introduced to warn users about macro execution risks. The root cause involves three distinct gaps: (1) parameter analysis limited to lowercase variants, allowing case-variant bypass; (2) failure to analyze macro parameters containing XWiki syntax such as information box titles; (3) insufficient analysis of 'source' parameters in content and context macros that can embed arbitrary XWiki syntax. The analyzer should prevent users without programming rights from silently injecting executable macros, but the incomplete checks allow obfuscation techniques to bypass these safeguards.
Affected Products
- vendor: XWiki; product: XWiki; affected_versions: ['15.9RC1 through 16.4.6', '16.10.0 through 16.10.2', '17.0.0-rc1 and earlier 17.x development versions']; fixed_versions: ['16.4.7', '16.10.3', '17.0.0']; vulnerability_scope: All XWiki installations with the macro rights analyzer feature enabled (default in 15.9RC1+); affected_components: ['Macro rights analyzer (xwiki-platform-rendering-xwiki-syntax)', 'Script macro execution engine', 'Groovy macro support', 'Python macro support']
Remediation
- priority: CRITICAL; action: Upgrade to patched versions; details: Apply security patches immediately: XWiki 16.4.7, 16.10.3, or 17.0.0 depending on installed branch. These versions include enhanced rights analyzers that properly validate macro parameters regardless of case, analyze parameters containing XWiki syntax, and inspect 'source' parameters in content/context macros. - priority: HIGH; action: Access control hardening; details: Restrict edit permissions to trusted users only. Disable or restrict macro usage (especially script/Groovy/Python macros) for non-programming users through XWiki permission model. Review existing page history for suspicious macro usage patterns, particularly case-variant parameters or obfuscated source attributes. - priority: MEDIUM; action: Detection and monitoring; details: Enable audit logging for page edits. Monitor for macros with mixed-case parameters (e.g., 'Script' vs 'script', 'SCRIPT') and 'source' parameters containing embedded syntax. Search wiki content for patterns: {{script...}}, {{groovy...}}, {{python...}} with non-standard casing or source parameter usage. - priority: LOW; action: Temporary mitigation (if patching delayed); details: Disable dangerous macro types (Script, Groovy, Python) via XWiki configuration if not required for operations. This removes attack surface but may break dependent functionality. Requires configuration rebuild and wiki restart.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today