CVE-2025-24893 XWiki Platform Eval Injection Exploitation

union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor =~ "XWiki" or DeviceProduct has_any ("xwiki", "XWiki")
  | where RequestURL has_any ("%7B%7B", "%24%7B", "{{velocity}}", "#set(", "velocity", "groovy")
    or RequestURL matches regex @"(?i)(\{\{[^}]+\}\}|\$\{[^}]+\}|%7B%7B|%24%7B)"
),
(
  W3CIISLog
  | where csUriStem has_any ("xwiki", "/bin/", "/download/")
  | where csUriQuery has_any ("%7B%7B", "groovy", "velocity", "%24%7B", "#set", "Runtime", "exec")
),
(
  AzureDiagnostics
  | where Category has_any ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog")
  | where requestUri_s has_any ("xwiki", "/bin/view", "/bin/edit")
  | where requestUri_s matches regex @"(?i)(groovy|velocity|\{\{|%7B%7B|exec|Runtime|ProcessBuilder)"
),
(
  Syslog
  | where ProcessName has_any ("java", "xwiki", "tomcat")
  | where SyslogMessage has_any ("groovy.lang", "ProcessBuilder", "Runtime.exec", "eval(", "{{velocity}}", "xwiki.groovy")
)
| extend ThreatIndicator = "CVE-2025-24893 XWiki Eval Injection"
| project TimeGenerated, ThreatIndicator, Computer, DeviceVendor, DeviceProduct, RequestURL, SourceIP, DestinationIP, Activity, AdditionalExtensions

index=* sourcetype IN ("access_combined", "access_combined_wcookie", "iis", "nginx:plus:kv", "apache:access", "syslog", "java_log")
(
  (uri_path="*/xwiki/*" OR uri_path="*/bin/view*" OR uri_path="*/bin/edit*" OR uri_path="*/bin/save*")
  AND
  (
    (uri_query IN ("*%7B%7B*", "*groovy*", "*velocity*", "*%24%7B*", "*#set(*", "*Runtime*", "*exec(*"))
    OR (request IN ("*{{*", "*${*", "*groovy*", "*velocity*", "*Runtime.exec*", "*ProcessBuilder*"))
  )
)
OR
(
  sourcetype="syslog"
  process IN ("java", "xwiki", "catalina")
  message IN ("*groovy.lang*", "*ProcessBuilder*", "*Runtime.exec*", "*eval(*", "*xwiki.groovy*")
)
| eval threat_indicator="CVE-2025-24893 XWiki Eval Injection"
| eval severity="critical"
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(src_ip) AS source_ips, values(uri_path) AS paths, values(uri_query) AS queries BY host, threat_indicator, severity
| where event_count > 0
| sort -event_count

sequence by host.name with maxspan=5m
  [network where
    (
      url.path like~ "*xwiki*" or url.path like~ "*/bin/view*" or url.path like~ "*/bin/edit*" or url.path like~ "*/bin/save*"
    )
    and
    (
      url.query like~ "*groovy*" or url.query like~ "*velocity*" or url.query like~ "*%7B%7B*" or
      url.query like~ "*%24%7B*" or url.query like~ "*Runtime*" or url.query like~ "*exec(*" or
      url.original like~ "*ProcessBuilder*" or url.original like~ "*{{*" or url.original like~ "*${*"
    )
  ]
  [process where
    process.name in ("java", "sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget")
    and process.parent.name in ("java", "catalina.sh", "wrapper", "jsvc")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  'CVE-2025-24893 XWiki Eval Injection' AS threat_indicator
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS', 'Linux OS', 'Tomcat')
  AND
  (
    (URL ILIKE '%xwiki%' OR URL ILIKE '%/bin/view%' OR URL ILIKE '%/bin/edit%' OR URL ILIKE '%/bin/save%')
    AND
    (
      URL ILIKE '%groovy%' OR URL ILIKE '%velocity%' OR URL ILIKE '%7B%7B%' OR
      URL ILIKE '%24%7B%' OR URL ILIKE '%Runtime%' OR URL ILIKE '%exec(%' OR
      URL ILIKE '%ProcessBuilder%' OR URL ILIKE '%#set(%'
    )
  )
  AND LOGSOURCETIME(starttime) > NOW() - 24 HOURS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=web/access OR _sourceCategory=syslog OR _sourceCategory=java/application
| where (%"cs-uri-stem" matches "*xwiki*" OR %"cs-uri-stem" matches "*/bin/view*" OR %"cs-uri-stem" matches "*/bin/edit*"
  OR url matches "*xwiki*" OR url matches "*/bin/view*" OR message matches "*xwiki*")
| where (%"cs-uri-query" matches "*groovy*" OR %"cs-uri-query" matches "*velocity*"
  OR %"cs-uri-query" matches "*%7B%7B*" OR %"cs-uri-query" matches "*%24%7B*"
  OR %"cs-uri-query" matches "*Runtime*" OR %"cs-uri-query" matches "*exec(*"
  OR url matches "*ProcessBuilder*" OR url matches "*{{*" OR message matches "*groovy.lang*"
  OR message matches "*Runtime.exec*" OR message matches "*ProcessBuilder*")
| parse field=_sourceHost "*" as host
| parse field=src_ip "*" as source_ip
| count by host, source_ip, url, message
| where _count > 0
| sort by _count desc
| fields host, source_ip, url, message, _count
| concat("CVE-2025-24893 XWiki Eval Injection - ", host) as alert_title

rule cve_2025_24893_xwiki_eval_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-24893 XWiki Platform eval injection exploitation attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j"
    cve = "CVE-2025-24893"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.request_url, `(?i)/xwiki/`) or
      re.regex($e.network.http.request_url, `(?i)/bin/(view|edit|save|download)`) or
      re.regex($e.network.http.request_url, `(?i)/rest/wikis/`)
    )
    (
      re.regex($e.network.http.request_url, `(?i)(groovy|velocity|ProcessBuilder|Runtime\.exec|%7B%7B|%24%7B)`) or
      re.regex($e.network.http.request_url, `\{\{[^}]+\}\}`) or
      re.regex($e.network.http.request_url, `\$\{[^}]+\}`) or
      re.regex($e.network.http.request_url, `#set\s*\(`) or
      re.regex($e.network.http.request_url, `(?i)exec\s*\(`)
    )

  condition:
    $e
}

#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, ProcessRollup2, SyntheticProcessRollup2)
| CommandLine LIKE "*java*" OR FileName IN ("java", "java.exe")
| ParentBaseFileName IN ("java", "catalina.sh", "startup.sh", "wrapper", "jsvc")
| ChildFileName IN ("sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "nc", "ncat", "ncat.exe", "whoami", "id", "net.exe")
| RemotePort IN (80, 443, 8080, 8443, 4444, 9999)
| RemoteAddressIP4 != "127.0.0.1" AND RemoteAddressIP4 != "::1"
| eval ThreatIndicator = "CVE-2025-24893 XWiki RCE Post-Exploitation"
| stats count() AS event_count, values(ChildFileName) AS spawned_processes, values(CommandLine) AS commands, earliest(timestamp) AS first_seen, latest(timestamp) AS last_seen BY ComputerName, UserName, FileName, ThreatIndicator
| where event_count > 0
| sort -event_count