CVE-2025-24893 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated Remote Code Execution (RCE) in XWiki Platform via `SolrSearch`. 💥 **Consequences**: Complete system compromise.…

🛡️ **Root Cause**: CWE-95 (Improper Neutralization of Special Elements in Code). The `SolrSearchMacros` component fails to properly sanitize user input, allowing template injection that leads to code execution.

📦 **Affected Versions**: • XWiki Platform >= 5.3-milestone-2, < 15.10.11 • XWiki Platform >= 16.0.0-rc-1, < 16.4.1 • All versions prior to the fixed releases listed above.

💀 **Attacker Capabilities**: As an unauthenticated guest, you can run **any** system command. This includes reading sensitive files, stealing database credentials, installing backdoors, or pivoting to internal networks.…

⚡ **Exploitation Threshold**: **EXTREMELY LOW**. • **Auth**: None required (Guest/Anonymous). • **UI**: None required (No user interaction). • **Network**: Remote (AV:N). • **Complexity**: Low (AC:L).

🔓 **Public Exploits**: **YES**. Multiple PoCs and full exploits are available on GitHub (e.g., `CVE-2025-24893.py`). Automated scanning templates (Nuclei) are also public. Wild exploitation is highly likely.

🔍 **Self-Check**: 1. Use Nuclei template: `CVE-2025-24893.yaml`. 2. Check if your XWiki version is in the affected range. 3. Look for the `SolrSearch` endpoint being accessible without authentication.

✅ **Official Fix**: **YES**. Patched in: • **15.10.11** • **16.4.1** • **16.5.0RC1** Update immediately to these versions or later.

🚧 **No Patch Workaround**: 1. **Block Access**: Restrict access to the `SolrSearch` endpoint via WAF or firewall rules. 2. **Disable Solr**: If not needed, disable the Solr search module. 3.…

🔥 **Urgency**: **CRITICAL (P0)**. CVSS 10.0 + Unauthenticated RCE + Public Exploits = Immediate action required. Patch within 24-48 hours or isolate the service.