CVE-2025-24893

Remote code execution as guest via SolrSearchMacros request in xwiki

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

XWiki Platform version 15.10.10 suffers from a remote code execution vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2025-01-27 CVE Reserved
2025-02-20 CVE Published
2025-02-20 CVE Updated
2025-02-26 First Exploit
2025-04-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CAPEC

References (8)

URL	Tag	Source
https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955	X_refsource_misc
https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824	X_refsource_misc
https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40	X_refsource_misc
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j	X_refsource_confirm
https://jira.xwiki.org/browse/XWIKI-22149	X_refsource_misc

URL	Date	SRC
https://packetstorm.news/files/id/190349	2025-04-08
https://www.exploit-db.com/exploits/52136	2025-04-07
https://github.com/iSee857/CVE-2025-24893-PoC	2025-02-26

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xwiki Search vendor "Xwiki"		Xwiki-platform Search vendor "Xwiki" for product "Xwiki-platform"				>= 5.3.0 < 15.10.11 Search vendor "Xwiki" for product "Xwiki-platform" and version " >= 5.3.0 < 15.10.11"		en		Affected
Xwiki Search vendor "Xwiki"		Xwiki-platform Search vendor "Xwiki" for product "Xwiki-platform"				>= 16.0.0 < 16.4.1 Search vendor "Xwiki" for product "Xwiki-platform" and version " >= 16.0.0 < 16.4.1"		en		Affected