CVE-2025-66474
📋 TL;DR
CVE-2025-66474 is an HTML injection vulnerability in XWiki Rendering that allows authenticated users to execute arbitrary script macros, leading to remote code execution. Attackers can gain unrestricted read/write access to all wiki content and execute system commands. This affects any XWiki instance with vulnerable versions where users have edit permissions.
💻 Affected Systems
- XWiki Rendering
- XWiki Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the XWiki instance with full administrative control, data exfiltration, and potential lateral movement to underlying infrastructure.
Likely Case
Unauthorized data access/modification, privilege escalation, and arbitrary code execution within the XWiki environment.
If Mitigated
Limited impact if proper access controls restrict edit permissions to trusted users only.
🎯 Exploit Status
Exploitation requires authenticated user with edit permissions. The vulnerability is in the rendering engine, making exploitation straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.10.10, 17.4.3, or 17.6.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p
Restart Required: Yes
Instructions:
1. Identify your XWiki version. 2. Upgrade to patched version: 16.10.10, 17.4.3, or 17.6.0-rc-1. 3. Restart the XWiki application server. 4. Verify the fix by checking version and testing rendering functionality.
🔧 Temporary Workarounds
Restrict Edit Permissions
allTemporarily limit document editing to only essential administrators until patching.
Configure XWiki permissions to restrict edit rights
Disable Script Macros
allDisable Groovy and Python script macros to prevent code execution.
Modify XWiki configuration to disable script macros
🧯 If You Can't Patch
- Implement strict access controls to limit who can edit documents
- Monitor for suspicious editing activity and script macro usage
🔍 How to Verify
Check if Vulnerable:
Check XWiki version against affected ranges. Review if users can edit documents containing HTML macros.Check Version:
Check XWiki administration panel or application logs for version informationVerify Fix Applied:
Confirm version is 16.10.10, 17.4.3, or 17.6.0-rc-1+. Test that {{/html}} injection no longer executes script macros.📡 Detection & Monitoring
Log Indicators:
- Unusual document edits
- Script macro executions
- HTML rendering errors
Network Indicators:
- HTTP POST requests to edit endpoints with suspicious content
SIEM Query:
Search for: 'edit' actions containing '{{/html}}' or script macro patterns in XWiki logs🔗 References
- https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11
- https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p
- https://jira.xwiki.org/browse/XRENDERING-693
- https://jira.xwiki.org/browse/XRENDERING-792
- https://jira.xwiki.org/browse/XRENDERING-793
- https://jira.xwiki.org/browse/XWIKI-23378
- https://jira.xwiki.org/browse/XRENDERING-693
- https://jira.xwiki.org/browse/XRENDERING-792
- https://jira.xwiki.org/browse/XRENDERING-793
