CVE-2025-24854 Overview
CVE-2025-24854 is a reflected Cross-Site Scripting (XSS) vulnerability in Apache JSPWiki. Attackers can craft a malicious request that abuses the Image plugin to inject JavaScript into a victim's browser session. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim and access sensitive information tied to the session.
The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Apache assigned this issue medium severity and released a fix in JSPWiki 2.12.3. Exploitation requires user interaction, typically by having the victim click a crafted link or visit an attacker-controlled page.
Critical Impact
A crafted request to the JSPWiki Image plugin executes attacker-controlled JavaScript in the victim's browser, enabling session data theft and account compromise.
Affected Products
- Apache JSPWiki versions prior to 2.12.3
- Deployments exposing the Image plugin to untrusted users
- Public-facing JSPWiki instances accepting anonymous or authenticated wiki edits
Discovery Timeline
- 2025-07-31 - CVE-2025-24854 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24854
Vulnerability Analysis
Apache JSPWiki is a Java-based wiki engine that supports extensible plugins for rendering dynamic content. The Image plugin allows users to embed and configure images inline within wiki markup. The plugin accepts parameters that influence the rendered HTML output.
The flaw stems from insufficient neutralization of user-controlled parameters passed to the Image plugin. Attacker-supplied values reach the rendered HTML without adequate encoding or sanitization. This produces reflected XSS in pages that process the crafted plugin invocation.
Because the vulnerability targets the browser context, an attacker can steal session cookies, exfiltrate wiki content the victim can read, or perform actions on the victim's behalf. Scope change in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, such as other pages served under the same origin.
Root Cause
The root cause is missing or incomplete output encoding of Image plugin parameters when JSPWiki renders wiki markup into HTML. User-controlled input flows into HTML attribute or content contexts without contextual escaping, allowing HTML and script fragments to break out of intended tags.
Attack Vector
Exploitation requires an attacker to deliver a link or wiki page that invokes the Image plugin with malicious parameters. When a victim visits the crafted URL or renders the poisoned wiki page, the browser executes the injected JavaScript under the JSPWiki origin. No prior authentication is required to craft the payload, but the victim must interact by loading the malicious content.
Refer to the Apache CVE-2025-24854 Summary and the OpenWall OSS Security Discussion for advisory details.
Detection Methods for CVE-2025-24854
Indicators of Compromise
- HTTP requests to JSPWiki endpoints containing Image plugin invocations with <script>, javascript:, or HTML event handler substrings such as onerror= or onload=.
- Wiki page revisions authored by low-reputation or anonymous accounts that introduce Image plugin calls with unusual attribute values.
- Outbound requests from user browsers to attacker-controlled domains immediately after loading a JSPWiki page.
Detection Strategies
- Inspect JSPWiki access logs for query strings and POST bodies containing encoded or literal script tags targeting the Image plugin.
- Deploy web application firewall rules that flag reflected XSS patterns in requests to Wiki.jsp and related endpoints.
- Review wiki page diffs for injected HTML attributes inside Image plugin parameters and alert on suspicious markup.
Monitoring Recommendations
- Enable verbose request logging for the JSPWiki application and forward logs to a central analytics platform for pattern matching.
- Monitor Content Security Policy (CSP) violation reports for inline script executions originating from wiki pages.
- Track authentication anomalies such as session reuse from unexpected geolocations following user visits to shared wiki links.
How to Mitigate CVE-2025-24854
Immediate Actions Required
- Upgrade Apache JSPWiki to version 2.12.3 or later on all production and staging instances.
- Audit existing wiki pages for Image plugin usage containing suspicious attributes and remove or sanitize malicious content.
- Rotate session tokens and invalidate active sessions for users who may have viewed compromised pages.
Patch Information
Apache has released Apache JSPWiki 2.12.3, which addresses CVE-2025-24854 by properly neutralizing user-supplied parameters processed by the Image plugin. Administrators should follow the upgrade instructions in the Apache JSPWiki advisory.
Workarounds
- Restrict wiki editing privileges to trusted, authenticated users until the upgrade is complete.
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Apply web application firewall rules to block requests containing script payloads targeting JSPWiki plugin parameters.
# Example CSP header to reduce XSS impact on JSPWiki responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
