Summary
A code injection vulnerability in XWiki Remote Macros allows executable macro syntax to be introduced through an included page's title or excerpt content. A user who can edit a page, even without script or programming rights, may trigger remote code execution when that page is included by the excerpt-include macro.
A code injection vulnerability in XWiki Remote Macros allows executable macro syntax to be introduced through an included page's title or excerpt content. A user who can edit a page, even without script or programming rights, may trigger remote code execution when that page is included by the excerpt-include macro.
Affected context
The issue affects XWiki Remote Macros deployments using the excerpt-include macro in affected releases. Risk arises when a page editor can control the included page title or excerpt and the macro renders that content as XWiki syntax using the macro's privileges. The vulnerable behavior is present where title escaping and excerpt-content isolation are insufficient.
The issue affects XWiki Remote Macros deployments using the excerpt-include macro in affected releases. Risk arises when a page editor can control the included page title or excerpt and the macro renders that content as XWiki syntax using the macro's privileges. The vulnerable behavior is present where title escaping and excerpt-content isolation are insufficient.
Exploit preconditions
- Attack surface: XWiki pages using the
excerpt-includemacro - Required access: Permission to edit a page whose title or excerpt can be included
- Trigger point: Rendering a page that includes the attacker-controlled content
- Why exploitation is possible: User-controlled text is interpreted as executable XWiki macro syntax and runs with the macro's rights
- Attack surface: XWiki pages using the
excerpt-includemacro - Required access: Permission to edit a page whose title or excerpt can be included
- Trigger point: Rendering a page that includes the attacker-controlled content
- Why exploitation is possible: User-controlled text is interpreted as executable XWiki macro syntax and runs with the macro's rights
Why this happens
The underlying bug is insufficient output encoding and trust-boundary enforcement for user-controlled title and excerpt content. The macro does not reliably escape the included page title, and it renders excerpt content in a way that permits XWiki syntax to be interpreted as executable macros. This maps to CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code, because data supplied by a page editor can become executable rendering logic.
The underlying bug is insufficient output encoding and trust-boundary enforcement for user-controlled title and excerpt content. The macro does not reliably escape the included page title, and it renders excerpt content in a way that permits XWiki syntax to be interpreted as executable macros. This maps to CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code, because data supplied by a page editor can become executable rendering logic.
Potential impact
- An attacker may execute code with the privileges available to the XWiki runtime
- Confidentiality of wiki content and connected services could be compromised
- Wiki data and configuration could be modified or deleted
- The availability of the XWiki installation could be disrupted
- Additional users, applications, or infrastructure could be affected through lateral activity
- An attacker may execute code with the privileges available to the XWiki runtime
- Confidentiality of wiki content and connected services could be compromised
- Wiki data and configuration could be modified or deleted
- The availability of the XWiki installation could be disrupted
- Additional users, applications, or infrastructure could be affected through lateral activity
General mitigation guidance
Mitigation generally focuses on preventing user-controlled content from being
interpreted as executable rendering logic.
Common defensive patterns include:
- Apply the vendor-supported remediation for the affected macro implementation
- Escape or contextually encode page titles before inserting them into rendered syntax
- Treat excerpts and other page-authored content as data rather than executable macros
- Use allowlisted, isolated rendering modes for content that must support limited formatting
- Reduce macro and runtime privileges according to least-privilege principles
- Restrict who can edit pages consumed by privileged or widely reused macros
- Add validation and security tests covering titles, excerpts, and nested macro rendering
Mitigation generally focuses on preventing user-controlled content from being
interpreted as executable rendering logic.
Common defensive patterns include:
- Apply the vendor-supported remediation for the affected macro implementation
- Escape or contextually encode page titles before inserting them into rendered syntax
- Treat excerpts and other page-authored content as data rather than executable macros
- Use allowlisted, isolated rendering modes for content that must support limited formatting
- Reduce macro and runtime privileges according to least-privilege principles
- Restrict who can edit pages consumed by privileged or widely reused macros
- Add validation and security tests covering titles, excerpts, and nested macro rendering
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of macro templates for direct interpolation of page titles or excerpts
- Code review checks for missing contextual escaping before content enters XWiki syntax
- Tests that submit markup-like content through all fields consumed by rendering macros
- Audit searches for
excerpt-includeusage and pages with unexpected macro syntax - Monitoring for unusual changes, administrative actions, or server-side command activity after page edits
- Policy enforcement requiring safe rendering APIs and security review for macros that execute with elevated rights
Automated code review and SAST tools may help identify unsafe interpolation and dynamic evaluation patterns.
Organizations can look for this class of issue through:
- Static analysis of macro templates for direct interpolation of page titles or excerpts
- Code review checks for missing contextual escaping before content enters XWiki syntax
- Tests that submit markup-like content through all fields consumed by rendering macros
- Audit searches for
excerpt-includeusage and pages with unexpected macro syntax - Monitoring for unusual changes, administrative actions, or server-side command activity after page edits
- Policy enforcement requiring safe rendering APIs and security review for macros that execute with elevated rights
Automated code review and SAST tools may help identify unsafe interpolation and dynamic evaluation patterns.
