CVE-2025-24893: Remote code execution as guest via SolrSearchMacros request in xwiki
First published: Thu Feb 20 2025(Updated: )
### Impact Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. ### Patches This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. ### Workarounds [This line](https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955) in `Main.SolrSearchMacros` can be edited to match the `rawResponse` macro defined [here](https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824) with a content type of `application/xml`, instead of simply outputting the content of the feed. ### References * https://jira.xwiki.org/browse/XWIKI-22149 * https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40 ### Attribution This vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XWiki Platform | <15.10.11<16.4.1<16.5.0RC1 | |
| maven/org.xwiki.platform:xwiki-platform-search-solr-ui | >=16.0.0-rc-1<16.4.1 | 16.4.1 |
| maven/org.xwiki.platform:xwiki-platform-search-solr-ui | >=5.3-milestone-2<15.10.11 | 15.10.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j
- https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40
- https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955
- https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824
- https://jira.xwiki.org/browse/XWIKI-22149
- https://nvd.nist.gov/vuln/detail/CVE-2025-24893
- https://github.com/advisories/GHSA-rr6p-3pfg-562j (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-24893?
CVE-2025-24893 is a high-severity vulnerability that allows arbitrary remote code execution.
How do I fix CVE-2025-24893?
To fix CVE-2025-24893, you should upgrade your XWiki Platform to a version higher than 16.5.0RC1.
What products are affected by CVE-2025-24893?
CVE-2025-24893 affects XWiki Platform versions up to 15.10.11, 16.4.1, and 16.5.0RC1.
Who can exploit CVE-2025-24893?
Any guest user can exploit CVE-2025-24893 to perform remote code execution through a request to SolrSearch.
What impact does CVE-2025-24893 have?
CVE-2025-24893 impacts the confidentiality, integrity, and availability of the entire XWiki installation.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rr6p-3pfg-562j
- alias/CVE-2025-24893
- agent/references
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- agent/author
- agent/severity
- collector/nvd-api
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory
- vendor/xwiki
- canonical/xwiki platform
- package-manager/maven