CVE-2025-54385: XWiki Platform SQL Injection Vulnerability

CVE-2025-54385 Overview

CVE-2025-54385 is a SQL Injection vulnerability affecting XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it. The vulnerability allows authenticated attackers to execute arbitrary SQL queries on Oracle database backends by exploiting insufficient input sanitization in the XWiki#searchDocuments APIs.

The vulnerability exists because the XWiki#searchDocuments APIs pass queries directly to Hibernate without proper sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query, such as the WHERE clause. This enables exploitation of Oracle-specific functions like DBMS_XMLGEN or DBMS_XMLQUERY to execute arbitrary SQL statements.

Critical Impact

Authenticated attackers with network access can execute arbitrary SQL queries against Oracle databases, potentially leading to complete database compromise, data exfiltration, or data manipulation.

Affected Products

• XWiki Platform versions 17.0.0-rc1 through 17.2.2
• XWiki Platform versions 16.10.5 and below
• XWiki Platform deployments using Oracle database backend

Discovery Timeline

• 2025-07-26 - CVE-2025-54385 published to NVD
• 2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-54385

Vulnerability Analysis

This vulnerability is classified as CWE-20 (Improper Input Validation). The core issue lies in how XWiki Platform handles user-supplied input when constructing database queries through its searchDocuments API.

The XWiki#searchDocuments APIs are designed to allow users to search for documents within the wiki. However, these APIs fail to adequately sanitize input before passing it to Hibernate for query execution. While the APIs attempt to enforce specific SELECT clauses to limit query scope, this protection can be bypassed.

The critical weakness is that HQL (Hibernate Query Language) supports native database functions. Attackers can leverage this feature to inject Oracle-specific functions like DBMS_XMLGEN or DBMS_XMLQUERY into other parts of the query, particularly the WHERE clause. These Oracle PL/SQL packages can be weaponized to execute arbitrary SQL statements, effectively bypassing the intended query restrictions.

Root Cause

The root cause is insufficient input validation and sanitization in the XWiki#searchDocuments APIs. The application trusts user-controlled input to construct HQL queries without proper escaping or parameterization of all query components. While SELECT clause restrictions are implemented, the WHERE clause and other query portions remain vulnerable to injection attacks that leverage HQL's native function call capabilities.

Attack Vector

The attack is network-based and requires authenticated access to the XWiki platform. An attacker with valid credentials can craft malicious search queries containing Oracle native function calls. When these queries are processed by the vulnerable searchDocuments APIs, the injected SQL code is executed directly against the Oracle database.

The exploitation path involves:

1. Authenticating to the XWiki platform with any valid user account
2. Crafting a malicious search query that includes Oracle native functions in the WHERE clause
3. Submitting the query through the XWiki#searchDocuments API
4. The injected functions execute arbitrary SQL commands with the database privileges of the application's database user

The vulnerability is particularly dangerous because DBMS_XMLGEN and DBMS_XMLQUERY can be used to construct and execute arbitrary SQL statements, enabling full read/write access to the database depending on configured permissions.

Detection Methods for CVE-2025-54385

Indicators of Compromise

• Unusual database queries containing DBMS_XMLGEN or DBMS_XMLQUERY function calls in application logs
• Unexpected access patterns or data retrieval operations in Oracle audit logs
• Error messages in XWiki logs indicating malformed or suspicious search queries
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Monitor application logs for search queries containing Oracle-specific function names such as DBMS_XMLGEN, DBMS_XMLQUERY, or similar PL/SQL packages
• Implement database activity monitoring to detect unusual query patterns or privilege escalation attempts
• Review Oracle audit logs for queries originating from the XWiki application that contain native function calls outside normal application behavior
• Deploy web application firewall (WAF) rules to detect SQL injection patterns targeting the search functionality

Monitoring Recommendations

• Enable verbose logging for the XWiki#searchDocuments API endpoints to capture all query parameters
• Configure Oracle database auditing to log all DDL and DML operations from the XWiki database user
• Set up alerts for queries containing potentially dangerous Oracle packages or functions
• Monitor for unusual data access patterns that may indicate data exfiltration attempts

How to Mitigate CVE-2025-54385

Immediate Actions Required

• Upgrade XWiki Platform to version 16.10.6 or 17.3.0-rc-1 immediately
• If immediate upgrade is not possible, restrict access to the searchDocuments API functionality
• Review database user permissions and apply principle of least privilege to the XWiki database account
• Implement network segmentation to limit direct database access from untrusted networks

Patch Information

XWiki has released security patches addressing this vulnerability. The fixes are available in versions 16.10.6 and 17.3.0-rc-1. The patches implement proper input sanitization for the searchDocuments APIs to prevent SQL injection through HQL native function calls.

Relevant security resources:

• GitHub Security Advisory GHSA-p9qm-p942-q3w5
• XWiki Issue Tracker XWIKI-22728
• Security Patch Commit 7313dc9
• Security Patch Commit 7c4087d
• XWiki 16.10.6 Release Notes

Workarounds

• Restrict access to the XWiki#searchDocuments API to trusted users only until patches can be applied
• If using Oracle database, consider revoking execute privileges on DBMS_XMLGEN and DBMS_XMLQUERY packages from the XWiki database user
• Implement a web application firewall with rules to block requests containing Oracle-specific function names in search parameters
• Consider temporarily switching to a non-Oracle database backend if feasible until the patch is deployed

# Revoke dangerous Oracle packages from XWiki database user (Oracle DBA)
REVOKE EXECUTE ON SYS.DBMS_XMLGEN FROM xwiki_user;
REVOKE EXECUTE ON SYS.DBMS_XMLQUERY FROM xwiki_user;