CVE-2025-24893

Published Feb 20, 2025

Last updated 6 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24893 is a critical remote code execution (RCE) vulnerability found in the XWiki Platform. It exists within the SolrSearch macro due to insufficient input sanitization. The vulnerability allows unauthenticated attackers to execute arbitrary Groovy code on affected servers. This can be achieved by sending a crafted HTTP request with a malicious payload to the vulnerable XWiki instance. The vulnerability stems from the way the SolrSearch macro evaluates search parameters, specifically when processing RSS feed requests, without proper sanitization of scripting language special characters. By injecting Groovy expressions into the search query, attackers can cause the system to evaluate arbitrary code within the context of the XWiki server process. This vulnerability affects XWiki Platform versions from 5.3-milestone-2 up to but not including 15.10.11, and from 16.0.0-rc-1 to 16.4.1.

Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Source: security-advisories@github.com
NVD status: Analyzed
Products: xwiki

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-95
nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9F2AD2E-CF5D-46D1-AFB8-2E9529C8E8D4",
            "versionEndExcluding": "15.10.11",
            "versionStartIncluding": "5.4"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5921C493-2A56-49BC-8763-7D12518C0DC2",
            "versionEndExcluding": "16.4.1",
            "versionStartIncluding": "16.0.0"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F5CC1FB7-2BAD-4413-9955-02E06BA27305"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:milestone2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "067AAD11-1AB2-4688-8D81-F2464CD2FA14"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2FCE7B4-E701-4C07-B4A9-31EC6C25F882"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.