Listen to this Post
How the CVE Works:
The vulnerability exists in the LESS compiler script API of XWiki, where cache-clearing operations lack proper programming rights validation. Attackers with script rights can abuse this flaw to forcibly clear caches, triggering unnecessary recompilation and slowing down the system. Though script rights already permit arbitrary script execution, this oversight amplifies misuse potential without escalation. The impact is limited to performance degradation due to cache rebuilds.
DailyCVE Form:
Platform: XWiki
Version: 15.10.0-16.7.0
Vulnerability: Cache-clearing bypass
Severity: Low
Date: Apr 29, 2025
What Undercode Say:
Analytics:
- Exploit Likelihood: Low (requires script rights)
- Attack Surface: Script-enabled users
- MITRE Tactic: Impact (Resource Hijacking)
Exploit Command:
curl -X POST http://xwiki-host/lessscript/cache/clear -H "X-API-Key: attacker-script-token"
Detection (Log Analysis):
grep "LESS cache cleared" /var/log/xwiki/application.log | awk '{print $1, $4}'
Protection:
1. Patch Upgrade:
sudo apt-get update && sudo apt-get install xwiki=16.8.0-rc1
2. Workaround (Restrict Script Rights):
<!-- xwiki.cfg --> restrict.script.rights=true
Code Fix (Java Snippet):
// Patched cache-clearing logic
if (!hasProgrammingRights()) {
throw new SecurityException("Cache clearance requires programming rights.");
}
Monitoring (Prometheus Alert):
alert: XWikiCacheFlood expr: rate(xwiki_cache_cleared_total[bash]) > 3 labels: severity: warning annotations: summary: "Excessive LESS cache clears (CVE-2025-XXXX)"
Mitigation Steps:
- Audit script rights assignments.
- Rate-limit cache-clearing API calls.
- Monitor performance metrics for anomalies.
Reference Checks:
xwiki-verify --version | grep -E "15.10.12|16.4.3|16.8.0"
Impact Verification:
ab -n 100 -c 10 http://xwiki-host/lessscript/cache/clear Pre/post-patch latency comparison
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
