org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

The impact of CVE-2025-32969 is severe. An attacker can leverage this SQL Injection vulnerability to execute arbitrary SQL statements against the database without authentication. This includes scenarios where the "Prevent unregistered users from viewing pages" and "Prevent unregistered users from editing pages" options are enabled, effectively bypassing intended access controls. Successful exploitation could lead to the exfiltration of sensitive data, such as password hashes, and even allow for unauthorized modification or deletion of data within the database. The potential for data breaches and system compromise is significant, particularly in environments where XWiki Platform is used to manage critical information.

Organizations using XWiki Platform REST Server for content management, collaboration, or knowledge sharing are at risk. This includes deployments where the platform handles sensitive data, such as user credentials or financial information. Shared hosting environments where multiple users share the same XWiki instance are particularly vulnerable, as a compromise of one user's account could lead to broader system access.

• java / server: Monitor XWiki Platform REST Server logs for unusual SQL queries or error messages indicative of injection attempts. Use a WAF to filter potentially malicious SQL statements.

grep -i 'error: syntax' /var/log/xwiki/xwiki.log

• database (mysql, postgresql): Monitor database audit logs for unexpected SQL commands originating from the XWiki Platform REST Server.

-- MySQL example
SELECT * FROM mysql.general_log WHERE command_type = 'Query' AND user = 'xwiki_user';

• generic web: Monitor access logs for requests to XWiki REST API endpoints that might be vulnerable to SQL injection.

 grep -i 'xwiki-platform-rest-server' /var/log/apache2/access.log

1. 2025-04-23Disclosure

   disclosure

1. 已保留2025-04-14
2. 发布日期2025-04-23
3. 修改日期2025-04-30
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-32969 is to upgrade XWiki Platform REST Server to version 15.10.16 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While direct SQL Injection prevention is difficult without patching, strict input validation and parameterized queries (if possible within the XWiki environment) can reduce the attack surface. Review and restrict database user permissions to limit the potential damage from a successful injection. After upgrading, verify the fix by attempting to access restricted database resources through the REST API while unauthenticated; successful access indicates the vulnerability persists.