CISA Warns of XWiki Platform Injection vulnerability Exploited to Execute Remote Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a severe injection vulnerability in the XWiki Platform, designated as CVE-2025-24893<\/a>.<\/p>\n This flaw allows unauthenticated attackers to execute arbitrary remote code, posing significant risks to organizations using the open-source wiki software.<\/p>\n Discovered and actively exploited, the vulnerability underscores the dangers of eval injection in web applications<\/a>, particularly those handling search functionalities.<\/p>\n XWiki, a popular platform for collaborative content management, suffers from this eval injection issue in its SolrSearch feature. Attackers can exploit it without logging in, potentially compromising entire installations.<\/p>\n CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 30, 2025, emphasizing the need for immediate action amid reports of real-world exploitation.<\/p>\n While it\u2019s unclear if ransomware groups are leveraging it specifically, the flaw\u2019s severity aligns with tactics seen in broader campaigns targeting content management systems.<\/p>\n At its core, CVE-2025-24893 stems from improper handling of user input in the SolrSearch endpoint, classified under CWE-95 for improper neutralization of directives in dynamically evaluated code. Any guest user can send a crafted request to trigger code execution.<\/p>\n For instance, a simple test involves accessing the SolrSearch RSS feed with a payload like %7D%7D%7D%7B%7Basync async=false%7D%7D%7B%7Bgroovy%7D%7Dprintln(\u201cHello from\u201d + \u201d search text:\u201d + (23 + 19))%7B%7B\/groovy%7D%7D%7B%7B\/async%7D%7D. If the response includes \u201cHello from search text:42\u201d in the RSS title, the instance is vulnerable.<\/p>\n The impact is devastating: complete remote code execution undermines confidentiality, integrity, and availability. Attackers could steal data, deploy malware, or pivot to other systems.<\/p>\n Affected versions include those prior to the patches, primarily impacting enterprise users in education, government, and corporate sectors who rely on XWiki for internal knowledge bases.<\/p>\nVulnerability Mechanics and Impact<\/strong><\/h2>\n