CVE-2025-53837: XWiki Rendering XML Eval Injection (Groovy/RCE)

let suspiciousTokens = dynamic(["{{groovy","{{script","{{velocity","{{async","Runtime.getRuntime","ProcessBuilder","getClass().forName","xwiki-rendering"]);
let WebHits = W3CIISLog
| where csUriStem has_any ("/bin/view","/bin/save","/bin/preview","/rest/","/xwiki/")
| extend Decoded = url_decode(coalesce(csUriQuery,""))
| where Decoded has_any (suspiciousTokens) or csMethod in ("POST","PUT")
| project TimeGenerated, cIP, csMethod, csUriStem, Decoded, scStatus, csUserName;
WebHits
| join kind=leftouter (
    DeviceProcessEvents
    | where InitiatingProcessFileName in~ ("java.exe","java","catalina.sh","tomcat9.exe")
    | where FileName in~ ("cmd.exe","powershell.exe","bash","sh","whoami.exe","nc.exe","curl","wget")
    | project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
) on $left.TimeGenerated == $right.ProcTime
| where isnotempty(FileName) or Decoded has_any ("{{groovy","{{script","Runtime.getRuntime","ProcessBuilder")
| project TimeGenerated, cIP, csUserName, csMethod, csUriStem, Decoded, scStatus, DeviceName, FileName, ProcessCommandLine

index=web (uri_path="*/bin/view*" OR uri_path="*/bin/save*" OR uri_path="*/bin/preview*" OR uri_path="*/rest/*")
| eval decoded=urldecode(coalesce(form_data, uri_query))
| search decoded="*{{groovy*" OR decoded="*{{script*" OR decoded="*{{velocity*" OR decoded="*Runtime.getRuntime*" OR decoded="*ProcessBuilder*" OR decoded="*getClass().forName*"
| join type=left _time [ search index=edr (parent_process_name="java*" OR parent_process_name="catalina*") (process_name="sh" OR process_name="bash" OR process_name="cmd.exe" OR process_name="powershell.exe" OR process_name="whoami*" OR process_name="curl" OR process_name="wget" OR process_name="nc") | fields _time host process_name process parent_process_name ]
| table _time src_ip user http_method uri_path decoded status host process_name process parent_process_name

sequence by host.id with maxspan=2m
  [ any where event.category == "web" and
      (url.path : ("*/bin/view*","*/bin/save*","*/bin/preview*","*/rest/*")) and
      (url.query : ("*groovy*","*script*","*Runtime.getRuntime*","*ProcessBuilder*") or http.request.method in ("POST","PUT")) ]
  [ process where event.type == "start" and
      process.parent.name : ("java","java.exe","catalina.sh") and
      process.name : ("sh","bash","cmd.exe","powershell.exe","whoami","curl","wget","nc") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "URL", "Request Method", "Post Body", starttime
FROM events
WHERE ("URL" ILIKE '%/bin/view%' OR "URL" ILIKE '%/bin/save%' OR "URL" ILIKE '%/rest/%')
AND ("Post Body" ILIKE '%{{groovy%' OR "Post Body" ILIKE '%{{script%' OR "Post Body" ILIKE '%Runtime.getRuntime%' OR "Post Body" ILIKE '%ProcessBuilder%' OR "URL" ILIKE '%groovy%')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=web/xwiki
| where (uri matches "*/bin/view*" or uri matches "*/bin/save*" or uri matches "*/rest/*")
| urldecode(field=post_body) as decoded
| where decoded matches "*{{groovy*" or decoded matches "*{{script*" or decoded matches "*Runtime.getRuntime*" or decoded matches "*ProcessBuilder*" or uri matches "*groovy*"
| count by src_ip, user, uri, method, status
| sort by _count desc

rule cve_2025_53837_xwiki_rendering_eval_injection {
  meta:
    author = "argus"
    cve = "CVE-2025-53837"
    severity = "CRITICAL"
    description = "XWiki Rendering XML eval injection RCE attempt"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.parsed_user_agent, `.*`) and
      $e.target.url = /.*\/(bin\/(view|save|preview)|rest)\/.*/ nocase
    )
    (
      $e.network.http.request_body = /.*(\{\{groovy|\{\{script|Runtime\.getRuntime|ProcessBuilder|getClass\(\)\.forName).*/ nocase or
      $e.target.url = /.*(groovy|script).*/ nocase
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(java|java\.exe|catalina\.sh)$/i
| ImageFileName=/(cmd\.exe|powershell\.exe|\/sh|\/bash|whoami|curl|wget|\/nc)$/i
| table([timestamp, ComputerName, ParentBaseFileName, FileName, CommandLine, aid])