CVE-2025-54385: 
Java vulnerability analysis and mitigation

CVE-2025-54385 is an SQL injection vulnerability in XWiki Platform's XWiki#searchDocuments API that allows attackers to execute arbitrary SQL queries against Oracle databases. It affects all versions from 1.0 up to (but not including) 16.10.6, and versions 17.0.0-rc1 through 17.2.2. The vulnerability was published on July 25, 2025, by the XWiki security team. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.6 (High) (Github Advisory, XWiki Advisory).

The root cause is improper input validation (CWE-20, CWE-89) in the XWiki#searchDocuments family of APIs within the xwiki-platform-oldcore Maven package. These APIs pass user-supplied HQL WHERE clauses directly to Hibernate without sanitization. Although the APIs enforce a fixed SELECT clause (e.g., select distinct doc.fullName), Hibernate's native function support allows attackers to embed Oracle-specific functions such as DBMS_XMLGEN or DBMS_XMLQUERY in the WHERE clause, which in turn accept arbitrary SQL strings and execute them against the underlying Oracle database (XWiki Advisory, Github Advisory). The fix introduces a checkSearchQueryAllowed method that validates the full constructed HQL statement via HQLStatementValidator.isSafe() before execution, and requires programming rights for queries that do not pass validation (Patch Commit).

Successful exploitation allows an attacker to execute arbitrary SQL queries against the Oracle database backend, enabling full confidentiality, integrity, and availability compromise of the database. An attacker can extract sensitive wiki content, user credentials, and configuration data; modify or delete database records; and potentially cause denial of service by abusing resource-intensive Oracle XML generation functions. The scope is limited to the vulnerable XWiki system's database, but data exfiltration could facilitate further lateral movement within the organization (XWiki Advisory, Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.979% (77th percentile), indicating a moderate probability of exploitation within 30 days relative to other vulnerabilities. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the attacker to have some level of authenticated access to the XWiki instance (CVSS v4.0 notes High Privileges Required), though the CVSS v3.1 score of 9.8 reflects a network-accessible, no-authentication-required attack surface under certain configurations (Github Advisory).

1. Reconnaissance: Identify XWiki instances running on Oracle databases at versions below 16.10.6 or between 17.0.0-rc1 and 17.2.2 using Shodan, Censys, or version disclosure pages.
2. Obtain access: Authenticate to the XWiki instance with any account that has access to wiki scripting or API endpoints exposing the searchDocuments API (e.g., via Velocity scripting in a wiki page).
3. Craft malicious HQL WHERE clause: Construct a WHERE clause that embeds an Oracle DBMS_XMLGEN.getxml() or DBMS_XMLQUERY.getxml() call containing an arbitrary SQL query, for example:

   where 1=1 AND DBMS_XMLGEN.getxml('SELECT username||chr(58)||password FROM xwiki_users') IS NOT NULL

4. Invoke the vulnerable API: Call XWiki.searchDocuments(maliciousWhereClause) through a Velocity script in a wiki page or via any exposed API endpoint that passes the clause unsanitized to Hibernate.
5. Extract results: Observe the query output or use error-based/out-of-band techniques (e.g., DNS exfiltration via Oracle UTL_HTTP) to retrieve the results of the injected SQL query from the Oracle database (XWiki Advisory, Oracle DBMS_XMLGEN Docs).

• Logs: XWiki application logs (xwiki.log) containing HQL queries with Oracle-specific function names such as DBMS_XMLGEN, DBMS_XMLQUERY, UTL_HTTP, or UTL_FILE in WHERE clauses; access log entries showing repeated or unusual calls to XWiki search API endpoints.
• Database: Oracle audit logs recording execution of DBMS_XMLGEN.getxml() or DBMS_XMLQUERY.getxml() with embedded SQL strings not matching normal application queries; unexpected queries against sensitive tables (e.g., user credential tables) originating from the XWiki application database user.
• Network: Unusual outbound connections from the Oracle database server (e.g., DNS or HTTP requests) that may indicate out-of-band data exfiltration via Oracle network packages (UTL_HTTP, UTL_DNS).
• Application: XWiki error messages referencing XWikiException.ERROR_XWIKI_ACCESS_DENIED with query validation failures (post-patch), which may indicate attempted exploitation against a patched instance.

XWiki has released patched versions 16.10.6 and 17.3.0-rc-1 that address this vulnerability by introducing HQL statement validation via HQLStatementValidator.isSafe() before executing search queries, and requiring programming rights for queries that fail validation (XWiki Advisory, Patch Commit). There is no known workaround other than upgrading to a patched version. As interim measures, administrators should restrict access to XWiki scripting capabilities, apply the principle of least privilege to the database account used by XWiki, enable Oracle database auditing for sensitive package calls, and consider deploying a WAF with rules to detect SQL injection patterns in XWiki API requests.