CVE-2024-55879

CRITICAL

XWiki 2.3-15.10.8 and 16.0.0-16.2.0 - Authenticated Remote Code Execution via ConfigurableClass Instance Addition

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-55879. PoCs published by dbwlsdnr95.

AI-analyzed exploit summary This repository contains a functional simulation of CVE-2024-55879, an RCE vulnerability in XWiki Platform, using Spring Boot and Groovy to demonstrate unsafe script execution. It includes a Dockerized environment, exploit simulation via curl, and detailed testing documentation.

Description

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.

Exploits (1)

nomisec WORKING POC

by dbwlsdnr95 · poc

https://github.com/dbwlsdnr95/CVE-2024-55879

View Code ZIP pw:eip

This repository contains a functional simulation of CVE-2024-55879, an RCE vulnerability in XWiki Platform, using Spring Boot and Groovy to demonstrate unsafe script execution. It includes a Dockerized environment, exploit simulation via curl, and detailed testing documentation.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: XWiki Platform 15.10.5 and below

Auth required

Prerequisites: Docker · XWiki admin access · Groovy script execution context

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 26, 2026 Full analysis →

References (4)

Core 4

Core References

Not Applicable

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398

Vendor Advisory x_refsource_confirm

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr

Patch x_refsource_misc

https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d

View Patch ZIP pw:eip

Exploit, Vendor Advisory x_refsource_misc

https://jira.xwiki.org/browse/XWIKI-21207

Scores

CVSS v3 9.1

EPSS 0.2002

EPSS Percentile 95.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-862

Status published

Products (3)

org.xwiki.platform/xwiki-platform-administration-ui 2.3 - 15.10.9Maven

xwiki/xwiki 16.0.0 - 16.3.0

xwiki/xwiki 2.3 - 15.10.9

Published Dec 12, 2024

Tracked Since Feb 18, 2026