xwiki
vulnerable target application
XWiki 15.10.10 service exposed on host port 8080, configured with a MySQL backend. It is the target for the CVE-2025-24893 exploit.
docker-compose.yml:2-15README.md:11-13kimtangker/CVE-2025-24893
PoC files
10 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python script that performs version detection, vulnerability validation, and interactive remote command execution against XWiki instances vulnerable to CVE-2025-24893 via SolrSearch template injection.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that exploits CVE-2025-24893 (XWiki SolrSearch RCE) by sending a crafted HTTP request to execute arbitrary commands on a vulnerable target. The script performs version detection, vulnerability validation, and command execution via the documented template injection vector. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm was observed in the reviewed text files.
ClassificationExploit
Model confidence98%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The script constructs and sends a malicious HTTP request containing a Groovy code injection payload that executes an arbitrary OS command (`command.execute().text`) and returns the result, which constitutes active exploitation, not just detection.
xwiki_exploit_module.py:218xwiki_exploit_module.py:207-247Requirements
- Target must be running a vulnerable XWiki version (5.3-milestone-2 to 15.10.10).
xwiki_exploit_module.py:160-168 - Target must expose the SolrSearch endpoint without authentication.
xwiki_exploit_module.py:218
Observed behavior
- Sends an HTTP GET request to the SolrSearch endpoint with a crafted payload that injects Groovy code to execute an arbitrary OS command and returns the output.
xwiki_exploit_module.py:218-224 - Extracts the command output from the XML/RSS response by searching for a specific pattern and stripping HTML tags.
xwiki_exploit_module.py:268-298 - Provides an interactive command loop that repeatedly executes user-supplied OS commands on the target until 'exit' is entered.
xwiki_exploit_module.py:249-266
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- /bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22{command}%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7dThe payload matches the CVE-2025-24893 description: it uses the SolrSearch endpoint with a Groovy template injection to execute an attacker-supplied command.
xwiki_exploit_module.py:218 - Local Logging
- xwiki_exploit.logThe script writes a local log file recording actions, URLs, and results. This is a local operational log, not a covert exfiltration channel.
xwiki_exploit_module.py:30xwiki_exploit_module.py:44-47
What the analysis did not establish
- Only two of ten repository files were provided as text; the remaining eight files (including docker-compose.yml and other potential artifacts) were omitted.
- The evidence was not executed; classification is based solely on static analysis of the provided source code.
- Only 2 of 10 files in the repository were provided as text evidence; 8 files were omitted. The review cannot assess content in those omitted files.
- Binary content, if any, was not analyzed per the evidence envelope policy.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2025-24893Compose · images
Analysis
Environment assessment
A Docker Compose environment running XWiki 15.10.10 with a MySQL 8.0 database, accompanied by a Python exploit script and log targeting CVE-2025-24893.
docker-compose.yml:1-33README.md:1-32xwiki_exploit_module.py:1-363Lab assessment
Vulnerability labThe README explicitly describes the environment as a CVE-2025-24893 analysis setup, the Compose file deploys a known vulnerable XWiki version, and the Python script is a dedicated exploit module for that CVE.
README.md:1-2README.md:11-13xwiki_exploit_module.py:1-10Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
db
database backend
MySQL 8.0 service providing persistent storage for XWiki, with credentials set via environment variables.
docker-compose.yml:17-26xwiki_exploit_module.py
exploit script
Python script that checks XWiki version, verifies CVE-2025-24893 vulnerability, and executes arbitrary commands via SolrSearch template injection. It logs actions to xwiki_exploit.log.
xwiki_exploit_module.py:1-10xwiki_exploit_module.py:30-33xwiki_exploit_module.py:200-220xwiki_exploit.log
exploit activity log
Log file recording version checks, POC checks, and command execution attempts against the XWiki target, showing successful RCE as root.
xwiki_exploit.log:1-41How the supplied evidence relates each vulnerability
CVE-2025-24893
Supported by supplied evidence
The README, exploit script, and log all reference CVE-2025-24893. The script targets XWiki 15.10.10, which is within the stated vulnerable range, and the log shows successful RCE via the described SolrSearch injection.
README.md:1-2README.md:11-13xwiki_exploit_module.py:1-10xwiki_exploit.log:4-6Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose must be installed to run the environment.
README.md:5-7 - XWiki must be initialized with an admin account, default extensions installed, and script rights granted to users.
README.md:9-13 - The exploit script requires Python 3 with the requests and colorama libraries.
xwiki_exploit_module.py:14-17
Evidence-described exercise path
- Start the XWiki and MySQL containers using docker-compose up -d.
README.md:5-7 - Access XWiki at http://localhost:8080, complete initial setup, create an admin account, install default extensions, and grant script rights.
README.md:9-13 - Run the exploit script, provide the target URL (e.g., localhost:8080), and use option 1 to check the version.
xwiki_exploit_module.py:330-340 - Use option 2 to verify the vulnerability via POC check, which executes whoami.
xwiki_exploit_module.py:200-220 - Use option 3 to enter interactive command execution mode and run arbitrary commands on the target.
xwiki_exploit_module.py:250-270
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the lab's own XWiki target. The exploit script only connects to the user-supplied target (expected to be the local container), logs actions locally, and does not attempt to escape the container, access the host, or contact external systems. No hidden, destructive, or backdoor behavior is present.
xwiki_exploit_module.py:30-33xwiki_exploit_module.py:200-220xwiki_exploit_module.py:330-340What the analysis did not establish
- The exploit script's extract_command_result method uses a regex pattern that may not reliably parse all responses; the log shows truncated output.
- The README contains typos (e.g., '생생', '부여여') that may indicate incomplete or rushed documentation.
- No Dockerfile is present; the environment relies solely on pre-built images, so internal image contents are uninspected.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.