Affected & Patched Versions

Affected Versions

• XWiki Platform: 5.3-milestone-2 through 15.10.10
• XWiki Platform: 16.0.0-rc-1 through 16.4.0

Patched Versions

• XWiki 15.10.11 or later
• XWiki 16.4.1 or later
• XWiki 16.5.0RC1 or later

Features

• Unauthenticated RCE: Execute arbitrary system commands without authentication.
• CSRF Token Bypass: Exploits template injection without requiring CSRF tokens.
• Background Execution: Runs commands asynchronously on the target server.
• Simple Command-Line Interface: Easy-to-use Bash script with minimal dependencies.

Prerequisites

• Dependencies:
  • curl: For sending HTTP requests.
  • jq: For URL encoding the payload.
  • Bash shell.
• Tested Environment: Linux OS with Bash.

Usage

Provide the Execution permissions:

Run the script with the required arguments:

Parameters

Example

Check if target is vulnerable (execute id command):

Retrieve system information:

Create a test file:

Reverse shell (replace with your IP and port):

Script Workflow

1. Command-line Argument Parsing:

   • Validates that both target URL and command are provided.
   • Normalizes the URL by adding http:// if no protocol is specified.

2. Payload Construction:

   • Builds a Groovy code payload that executes the specified command using .execute().
   • Wraps the payload in XWiki macro syntax: }}}{{async async=false}}{{groovy}}<code>{{/groovy}}{{/async}}

3. URL Encoding:

   • URL-encodes the payload using jq for proper HTTP transmission.

4. Exploitation:

   • Sends an HTTP GET request to the vulnerable SolrSearch endpoint: /xwiki/bin/get/Main/SolrSearch?media=rss&text=<encoded_payload>
   • Command executes in the background on the target server.

Technical Details

Exploitation Mechanism

The exploit chain works as follows:

1. Template Injection: The attacker crafts a malicious payload containing Groovy code wrapped in XWiki macro syntax.
2. Endpoint Targeting: The payload is sent to the vulnerable SolrSearch RSS endpoint.
3. Code Execution: The injected Groovy code is executed server-side without authentication.
4. System Compromise: The attacker gains arbitrary code execution with the privileges of the XWiki application.

Payload Structure

• }}} - Closes any existing macro context
• {{async async=false}} - Ensures synchronous execution
• {{groovy}}...{{/groovy}} - Wraps the malicious Groovy code
• '<command>'.execute(); - Executes the specified system command

Proof of Concept

Vulnerable Environment Setup

For testing purposes, you can set up a vulnerable XWiki instance using Docker:

Exploitation Demo

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to:

• Execute arbitrary system commands on the server
• Read, modify, or delete sensitive data
• Compromise the entire XWiki installation
• Pivot to other systems on the network
• Deploy cryptocurrency miners or other malware
• Establish persistent backdoor access

Real-World Exploitation

According to CISA and multiple security vendors:

• Active Exploitation: CVE-2025-24893 is being actively exploited in the wild
• Attack Campaigns: VulnCheck detected two-stage attack chains deploying cryptocurrency miners
• CISA KEV Catalog: Added to Known Exploited Vulnerabilities catalog on October 30, 2025
• Widespread Scanning: Mass internet-wide scanning for vulnerable instances

Detection & Mitigation

Detection

Monitor for suspicious requests to the SolrSearch endpoint:

Look for patterns containing:

• {{groovy}}
• {{async}}
• .execute()
• URL-encoded variations of the above

Indicators of Compromise (IoCs)

• Unexpected processes spawned by the XWiki application user
• New files in /tmp or other writable directories
• Outbound network connections to unknown IPs
• Cryptocurrency mining processes (high CPU usage)

Mitigation

1. Upgrade XWiki to a patched version:

   • Version 15.10.11 or later
   • Version 16.4.1 or later
   • Version 16.5.0RC1 or later

2. Apply Temporary Workarounds (if immediate patching is not possible):

   • Restrict access to the SolrSearch endpoint via Web Application Firewall (WAF)
   • Disable the SolrSearch macro if not required
   • Implement network segmentation to limit exposure

3. Monitor for Compromise:

   • Review logs for exploitation attempts
   • Check for unauthorized file modifications
   • Scan for cryptocurrency miners and backdoors

Limitations

• Commands execute in the background; output may not be immediately visible.
• Verification of command execution requires side-channel methods (e.g., creating files, network connections).
• Requires the target to have the SolrSearch macro enabled (default configuration).

Credits

• Vulnerability Discoverer: John Kwak (Trend Micro's Zero Day Initiative)
• Original Python Exploit Authors: Various security researchers
• Adapted Script: Refurbished by [0xdtc] Built in BASH

Disclaimer

This script is for educational purposes only. Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal and unethical. Use responsibly.

You must have explicit written permission from the system owner before testing.

The author(s) of this tool are not responsible for any misuse or damage caused by this script. Users are solely responsible for ensuring they have proper authorization and comply with all applicable laws and regulations.