XWiki Rendering ist anfällig für XSS-Angriffe durch unsichere XHTML-Syntax

The vulnerability stems from the XHTML syntax relying on the xdom+xml/current syntax, which permits the creation of raw blocks. These raw blocks allow the insertion of arbitrary HTML content, including JavaScript. An attacker can exploit this by setting the document's syntax to xdom+xml/current and then injecting malicious code. Successful exploitation could allow an attacker to steal user credentials, deface the XWiki instance, or redirect users to malicious websites. Given XWiki's use in many organizations for internal documentation and collaboration, the potential impact is significant, particularly if user profiles are enabled for editing, as is the default configuration.

Organizations using XWiki for internal documentation, collaboration, or knowledge management are at risk. Specifically, deployments with user profiles enabled for editing are particularly vulnerable, as attackers can directly modify user profiles to inject malicious code. Shared hosting environments where multiple users have access to XWiki instances also face increased risk.

• java: Monitor XWiki logs for attempts to set document syntax to xdom+xml/current.

grep 'syntax=xdom+xml/current' /path/to/xwiki/logs/xwiki.log

• generic web: Check for suspicious HTML tags or JavaScript code in XWiki document content using a WAF or manual inspection. • generic web: Monitor access logs for requests containing unusual HTML or JavaScript patterns. • generic web: Review XWiki document templates for potential vulnerabilities related to raw HTML insertion.

1. 2025-07-14Disclosure

   disclosure

1. Reserviert2025-07-09
2. Veröffentlicht2025-07-14
3. Geändert2025-07-15
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to XWiki version 14.10 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider restricting document editing permissions to trusted users only. While not a complete solution, this can limit the attack surface. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious HTML tags or JavaScript code within document content. Monitor XWiki logs for unusual activity, particularly attempts to modify document syntax or insert raw HTML blocks. There are no specific Sigma or YARA rules available at this time, but general XSS detection rules should be applied.