XWiki Rendering é vulnerável a ataques de RCE ao processar macros aninhadas

The core of the vulnerability lies in the macro content parser's failure to properly preserve the 'restricted' attribute of the transformation context when executing nested macros. This oversight enables the execution of macros that are normally forbidden in restricted mode, particularly script macros. The Cache and Chart macros, bundled with XWiki, are directly impacted by this flaw. An attacker can exploit this by crafting malicious XWiki syntax, embedding it within a comment, and leveraging the privilege escalation to execute arbitrary code. This could lead to data breaches, system takeover, and potential lateral movement within the network if XWiki is integrated with other systems.

Organizations heavily reliant on XWiki for content management, collaboration, or knowledge sharing are particularly at risk. This includes those using XWiki in sensitive environments or those with limited security expertise. Shared hosting environments where multiple users share the same XWiki instance are also at increased risk, as a compromise of one user's account could potentially lead to a broader system compromise.

• java / server: Monitor XWiki logs for unusual macro execution patterns, particularly those involving nested macros or script macros. Look for attempts to bypass restricted mode.

journalctl -u xwiki -f | grep -i "macro execution"

• generic web: Examine XWiki access logs for requests containing suspicious macro syntax within comments. Use curl to test for macro execution vulnerabilities.

curl 'http://xwiki/xwiki/bin/view/Main/YourPage?syntax=<malicious_macro_syntax>' -v

• wordpress / composer / npm: (Not applicable, as XWiki is a Java-based application) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability does not directly involve the database) • windows / supply-chain: (Not applicable, as XWiki is a Java-based application)

1. 2025-07-14Disclosure

   disclosure

1. Reservado2025-07-09
2. Publicada2025-07-14
3. Modificada2025-07-15
4. EPSS atualizado2026-03-23

The primary mitigation is to immediately upgrade to XWiki version 13.10.11 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restricting user permissions to prevent the execution of script macros is a crucial step. Review and audit all XWiki configurations to ensure the principle of least privilege is enforced. While a WAF or proxy rule cannot directly prevent this vulnerability, it can help detect and block suspicious macro execution patterns. Monitor XWiki logs for unusual macro activity and consider implementing a Sigma or YARA rule to detect malicious macro syntax.