Listen to this Post
The vulnerability exists in the XWiki Jetty package (XJetty), which improperly exposes a static file-serving context. This context is mapped to the root `webapp/` directory of the XWiki installation. By default, Jetty serves static files from defined resource bases. In the affected configurations, the context path for accessing these static files was not properly restricted or validated. An attacker can construct a direct URL path traversal to access any file within the `webapp/` folder hierarchy. For example, requesting http://host/webapps/xwiki/WEB-INF/xwiki.properties` bypasses any intended access controls because the request is handled by the static file servlet, not the application's security layer. This servlet does not differentiate between public resources and sensitive configuration files, leading to arbitrary file disclosure. The vulnerability is critical as files likexwiki.cfg,xwiki.properties`, and `hibernate.cfg.xml` often contain database credentials, encryption keys, and other sensitive deployment configuration.
Platform: XWiki (XJetty)
Version: >=16.7.0 <16.10.11
Vulnerability: Arbitrary File Disclosure
Severity: High
date: 2025-12-01
Prediction: Patch Released 2025-12-01
What Undercode Say:
Showing bash commands and codes related to the blog
Example curl request to test for vulnerable endpoint curl -v http://target-host/webapps/xwiki/WEB-INF/xwiki.properties Workaround: Edit start_xwiki.sh script sed -i 's|original_jar_line|patched_jar_line|' start_xwiki.sh
How Exploit:
Attacker sends crafted HTTP GET request to exposed static context path targeting sensitive files in WEB-INF directory.
Protection from this CVE:
Apply official patches (16.10.11, 17.4.4, 17.7.0) or implement provided script workaround.
Impact:
Disclosure of credentials, database passwords, and full application configuration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
