CVE-2025-24893criticalbajo ataqueCWE-95

CVE-2025-24893: fallo crítico en xwiki-platform

Remote code execution as guest via SolrSearchMacros request in xwiki

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear xwiki-platform+ Monitorear XWiki Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 9.8epss 100%
de la publicación al arma5 días
Publicada en NVD20 feb
1ª PoC+5d
metasploit20 feb
CISA KEV+252d
Acción exigida por CISAplazo federal: 2025-11-20

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

En resumen

Cualquier visitante de un sitio XWiki puede ejecutar código arbitrario en el servidor sin iniciar sesión, enviando una solicitud especialmente diseñada a la función de búsqueda. Esto compromete completamente la confidencialidad, integridad y disponibilidad de toda la instalación.

Detalle técnico

La macro SolrSearch no desinfecta adecuadamente el parámetro `text` proporcionado por el usuario antes de evaluarlo como código, permitiendo que atacantes no autenticados inyecten y ejecuten código Groovy arbitrario en el servidor. La vulnerabilidad existe en el mecanismo de respuesta que muestra el contenido del feed sin escapar adecuadamente ni restringir el tipo de contenido.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
xwiki · xwiki-platform
PoCs públicas encontradas — 98
exploitdbwww.exploit-db.com/exploits/52429no verificadoexploitdbwww.exploit-db.com/exploits/52136no verificadogithubgithub.com/gunzf0x/CVE-2025-24893★ 23githubgithub.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC★ 17githubgithub.com/b0ySie7e/CVE-2025-24893★ 11githubgithub.com/iSee857/CVE-2025-24893-PoC★ 10githubgithub.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE★ 6githubgithub.com/Infinit3i/CVE-2025-24893★ 6githubgithub.com/AliElKhatteb/CVE-2024-32019-POC★ 5githubgithub.com/hackersonsteroids/cve-2025-24893★ 5githubgithub.com/gotr00t0day/CVE-2025-24893★ 5githubgithub.com/D3Ext/CVE-2025-24893★ 4githubgithub.com/570RMBR3AK3R/xwiki-cve-2025-24893-poc★ 3githubgithub.com/BreakingRohit/CVE-2025-24893-PoC★ 2githubgithub.com/Artemir7/CVE-2025-24893-EXP★ 2githubgithub.com/torjan0/xwiki_solrsearch-rce-exploit★ 2githubgithub.com/IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch★ 1githubgithub.com/80Ottanta80/CVE-2025-24893-PoC★ 1githubgithub.com/vasilysaint/CVE-2025-24893★ 1githubgithub.com/nohack1212/CVE-2025-24893-★ 1githubgithub.com/x0da6h/POC-for-CVE-2025-24893★ 1githubgithub.com/Yukik4z3/CVE-2025-24893★ 1githubgithub.com/Th3Gl0w/CVE-2025-24893-POC★ 1githubgithub.com/CMassa/CVE-2025-24893★ 0githubgithub.com/AzureADTrent/CVE-2025-24893-Reverse-Shell★ 0githubgithub.com/0xDTC/XWiki-Platform-RCE-CVE-2025-24893★ 0githubgithub.com/kimtangker/CVE-2025-24893★ 0githubgithub.com/mah4nzfr/CVE-2025-24893★ 0githubgithub.com/The-Red-Serpent/CVE-2025-24893★ 0githubgithub.com/Bishben/xwiki-15.10.8-reverse-shell-cve-2025-24893★ 0githubgithub.com/Y2F05p2w/CVE-2025-24893★ 0githubgithub.com/TomKingori/xwiki-cve-2025-24893-exploit★ 0githubgithub.com/rippsec/CVE-2025-24893-XWiki-SSTI-RCE★ 0githubgithub.com/Fomovet/cve-2025-24893★ 0githubgithub.com/gmh5225/CVE-2025-24893-RCE-PoC★ 0githubgithub.com/zs1n/CVE-2025-24893★ 0githubgithub.com/ibadovulfat/CVE-2025-24893★ 0githubgithub.com/rvzsec/CVE-2025-24893★ 0githubgithub.com/hasecto/CVE-2025-24893★ 0githubgithub.com/endusdksla/xwiki-cve-2025-24893★ 0githubgithub.com/MattiaCervelli/CVE-2025-24893_Analysis★ 0githubgithub.com/dhiaZnaidi/CVE-2025-24893-PoC★ 0githubgithub.com/Retro023/CVE-2025-24893-POC★ 0githubgithub.com/andwati/CVE-2025-24893★ 0githubgithub.com/o0wo0o/CVE-2025-24893_Shell★ 0githubgithub.com/alaxar/CVE-2025-24893★ 0githubgithub.com/investigato/cve-2025-24893-poc★ 0vulncheckvulncheck.com/xdb/e8b041b40fccno verificadovulncheckvulncheck.com/xdb/444954e3b786no verificadovulncheckvulncheck.com/xdb/93f5e4efb877no verificadovulncheckvulncheck.com/xdb/596098d5a2f9no verificadovulncheckvulncheck.com/xdb/65f834835fd6no verificadovulncheckvulncheck.com/xdb/05bdc5c383fbno verificadovulncheckvulncheck.com/xdb/fbf9dfffc712no verificadovulncheckvulncheck.com/xdb/d68432820abeno verificadovulncheckvulncheck.com/xdb/06c9fbe27cd0no verificadovulncheckvulncheck.com/xdb/bb78fdf33a59no verificadovulncheckvulncheck.com/xdb/c57ce2c0f88dno verificadovulncheckvulncheck.com/xdb/e806dec4d316no verificadovulncheckvulncheck.com/xdb/fbb9d786622bno verificadovulncheckvulncheck.com/xdb/b046aa232c71no verificadovulncheckvulncheck.com/xdb/789a8c6825b2no verificadovulncheckvulncheck.com/xdb/71fda264aebcno verificadovulncheckvulncheck.com/xdb/89494e523180no verificadovulncheckvulncheck.com/xdb/2391f1ba6766no verificadovulncheckvulncheck.com/xdb/1538898e5c9dno verificadovulncheckvulncheck.com/xdb/e0d8e8479af7no verificadovulncheckvulncheck.com/xdb/d1b7aef06a77no verificadovulncheckvulncheck.com/xdb/86a950545a1ano verificadovulncheckvulncheck.com/xdb/ed7f1245d21bno verificadovulncheckvulncheck.com/xdb/8682205ce5c3no verificadovulncheckvulncheck.com/xdb/6b471e7ef67fno verificadovulncheckvulncheck.com/xdb/286c3bfb8170no verificadovulncheckvulncheck.com/xdb/080d40055775no verificadovulncheckvulncheck.com/xdb/6ab6a9ee7d8fno verificadovulncheckvulncheck.com/xdb/a7c585dc65b2no verificadovulncheckvulncheck.com/xdb/d106a5e812c8no verificadovulncheckvulncheck.com/xdb/33abb14390c6no verificadovulncheckvulncheck.com/xdb/3f52024d7a6dno verificadovulncheckvulncheck.com/xdb/9b38b7649f7cno verificadovulncheckvulncheck.com/xdb/64f274f6eb64no verificadovulncheckvulncheck.com/xdb/2dffa3000fabno verificadovulncheckvulncheck.com/xdb/dec237ab6767no verificadovulncheckvulncheck.com/xdb/bb055c349a1eno verificadovulncheckvulncheck.com/xdb/edaa9b83cb33no verificadovulncheckvulncheck.com/xdb/53bca8061977no verificadovulncheckvulncheck.com/xdb/3e5b42bc93c5no verificadovulncheckvulncheck.com/xdb/bfeb32c2c60cno verificadovulncheckvulncheck.com/xdb/5855609e4d40no verificadovulncheckvulncheck.com/xdb/e583ae8e9370no verificadovulncheckvulncheck.com/xdb/e8a608a67a7eno verificadovulncheckvulncheck.com/xdb/6d2a0b82c683no verificadovulncheckvulncheck.com/xdb/ccc3579adc13no verificadovulncheckvulncheck.com/xdb/74202de07260no verificadovulncheckvulncheck.com/xdb/831618aeeeceno verificadovulncheckvulncheck.com/xdb/37339d012dc5no verificadovulncheckvulncheck.com/xdb/1b13eb840965no verificadovulncheckvulncheck.com/xdb/d7f7ed50e901no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — xwiki-platform

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 89.7%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%CVE-2024-31984CRITICALXWiki Platform: Remote code execution through space title and Solr space facetEPSS 83.0%