CVE-2025-24853: Apache JSPWiki XSS Vulnerability

CVE-2025-24853 Overview

CVE-2025-24853 is a stored Cross-Site Scripting (XSS) vulnerability in Apache JSPWiki. Attackers can craft a malicious request when creating a header link using the wiki markup syntax. The crafted payload executes JavaScript in a victim's browser when the affected page is viewed. Subsequent research by the JSPWiki team confirmed the markdown parser is also susceptible to the same attack pattern. The vulnerability impacts the integrity of user sessions and can be used to exfiltrate sensitive information from authenticated victims. Apache JSPWiki users should upgrade to version 2.12.3 or later to remediate the flaw. The weakness is tracked under [CWE-79].

Critical Impact
Remote, unauthenticated attackers can inject JavaScript into wiki pages and steal session data or sensitive information from any user who views the malicious content.

Affected Products

Apache JSPWiki versions prior to 2.12.3
Apache JSPWiki wiki markup header link parser
Apache JSPWiki markdown parser

Discovery Timeline

2025-07-31 - CVE-2025-24853 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-24853

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) flaw classified under [CWE-79]. Apache JSPWiki fails to properly sanitize attacker-controlled content embedded within header link constructs in its wiki markup syntax. When a user authors or edits a page using a crafted header link, the parser produces output containing executable JavaScript. Any subsequent visitor who renders the affected page triggers the payload in their browser context.

The Apache JSPWiki team later identified that the markdown parser shares the same unsafe handling. This expands the attack surface to deployments that have opted into markdown rendering. The flaw can be exploited over the network without prior authentication, depending on how the target wiki permits page edits.

Exploitation primarily affects integrity. Attackers can steal session cookies, exfiltrate sensitive page content, perform actions on behalf of the victim, or pivot to additional attacks against the wiki environment.

Root Cause

The root cause is improper neutralization of input during web page generation within the JSPWiki header link parsing logic. Both the legacy wiki markup parser and the markdown parser fail to escape or sanitize attributes inside generated header link anchors. The parsers allow attacker-supplied JavaScript constructs to survive into the rendered HTML output.

Attack Vector

An attacker submits a page edit or new page containing a malicious header link using wiki markup or markdown syntax. The server stores the unsanitized content. When a victim loads the page, the browser parses and executes the embedded JavaScript. The payload runs with the victim's session privileges in the wiki origin. No user interaction beyond viewing the page is required. Refer to the Apache JSPWiki CVE-2025-24853 advisory for additional technical context.

Detection Methods for CVE-2025-24853

Indicators of Compromise

Wiki pages containing header link syntax with embedded javascript: URI schemes or event handler attributes such as onerror, onclick, or onload.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after viewing wiki pages.
Page revision history showing edits from low-reputation accounts that introduce header link constructs with unusual attribute payloads.
Session token reuse from geolocations that do not match the legitimate user.

Detection Strategies

Audit the JSPWiki page repository for stored content containing <script>, javascript:, or HTML event handlers within rendered header link elements.
Inspect web server access logs for POST requests to page edit endpoints containing suspicious markup payloads.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts originating from wiki pages.
Compare page diffs against a known-good baseline to identify injection attempts in header constructs.

Monitoring Recommendations

Forward JSPWiki application logs and reverse proxy access logs to a centralized analytics platform for correlation.
Alert on edits that introduce HTML attributes or URI schemes not expected in standard wiki markup.
Monitor authenticated user sessions for anomalous activity, including unexpected administrative actions following page views.
Track CSP violation reports to identify which pages and users encountered injected scripts.

How to Mitigate CVE-2025-24853

Immediate Actions Required

Upgrade Apache JSPWiki to version 2.12.3 or later on all production and staging instances.
Review recent page edits for malicious header link constructs and revert any pages containing injected JavaScript.
Rotate session credentials and force re-authentication for users who may have viewed compromised pages.
Restrict page editing permissions to trusted users until the upgrade is complete.

Patch Information

Apache has released Apache JSPWiki 2.12.3, which addresses the unsafe header link handling in both the wiki markup parser and the markdown parser. Administrators should obtain the patched release from the official Apache JSPWiki distribution channels. Full advisory details are available in the Apache JSPWiki CVE-2025-24853 advisory and the Openwall OSS Security discussion.

Workarounds

Disable anonymous and untrusted user page editing until the upgrade can be applied.
Enforce a strict Content Security Policy that blocks inline script execution and javascript: URIs.
Place the wiki behind a web application firewall configured to inspect and block payloads matching XSS patterns in page edit requests.
Temporarily disable the markdown parser if it is not required for the deployment.

bash

# Example strict CSP header for an Apache reverse proxy fronting JSPWiki
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"