Incident : Vulnerability Exploitation

XWI2092520103125

Exposure Impact

Title: Critical Eval Injection Vulnerability in XWiki Platform (CVE-2025-24893)

Description: The Cybersecurity and Infrastructure Security Agency (CISA) has formally added CVE-2025-24893 to its Known Exploited Vulnerabilities catalog, drawing urgent attention to a critical eval injection flaw affecting XWiki Platform. This vulnerability permits any guest user to execute arbitrary remote code without requiring authentication, posing an acute security risk to organizations deploying this widely used open-source wiki platform across their infrastructure. The vulnerability stems from improper handling of eval functions within the XWiki Platform’s SolrSearch component, classified under CWE-95 for the improper neutralization of directives in dynamically evaluated code. Unauthenticated attackers can craft specially engineered requests to inject malicious code, bypassing established security controls and gaining complete command execution capabilities on affected systems. Once code execution is achieved, threat actors inherit the same privileges as the web server process, enabling them to exfiltrate sensitive organizational data, deploy malware payloads, or establish persistent network footholds for lateral movement attacks. CISA has established November 20, 2025, as the critical remediation deadline for organizations operating affected XWiki Platform instances.

Type: Vulnerability Exploitation

Attack Vector: Network

Vulnerability Exploited: Cve Id: CVE-2025-24893, Affected Product: XWiki Platform, Vulnerability Type: Eval Injection (CWE-95), Cvss Score: 9.8, Cvss Severity: Critical, Affected Component: SolrSearch, Authentication Required: None, Attack Complexity: Low.

Incident : Vulnerability Exploitation

XWI0133201111725

Exposure Impact

Title: Widespread Exploitation of Critical XWiki Vulnerability (CVE-2025-24893)

Description: Cybersecurity researchers have detected a dramatic surge in exploitation attempts targeting a critical XWiki vulnerability (CVE-2025-24893), with multiple threat actors actively deploying botnets (e.g., RondoDox), cryptocurrency miners, reverse shells, and custom malware to compromise vulnerable servers worldwide. The vulnerability evolved from isolated attacks to widespread exploitation within days, leaving defenders with minimal time to patch systems. Exploitation includes botnet integration, coin mining campaigns, reverse shell establishment, and automated scanning operations.

Date Detected: 2025-10-28

Date Publicly Disclosed: 2025-10-28

Type: Vulnerability Exploitation

Attack Vector: Remote Code Execution (RCE)Exploitation of CVE-2025-24893 in XWiki

Vulnerability Exploited: CVE-2025-24893 (Critical RCE in XWiki)

Threat Actor: Name: RondoDox Botnet, Type: Botnet Operator, Indicators: {'user_agent': 'rondo.<value>.sh', 'ip_addresses': ['74.194.191.52'], 'first_observed': '2025-11-03'}, Name: Unknown Cryptocurrency Mining Group 1, Type: Cryptojacking Operator, Indicators: {'ip_addresses': ['172.245.241.123', '47.236.194.231'], 'domains': ['ospwrf10ny.anondns[.]net'], 'payload_hash': '03a77a556f074184b254d90e13cdd3a31efaa5a77640405e5f78aa462736acf7'}, Name: Unknown Cryptocurrency Mining Group 2, Type: Cryptojacking Operator, Indicators: {'ip_addresses': ['156.146.56.131']}, Name: Unknown Reverse Shell Actor 1, Type: Sophisticated Threat Actor, Indicators: {'ip_addresses': ['18.228.3.224'], 'tactics': ['AWS-hosted reverse shell via BusyBox netcat']}, Name: Unknown Reverse Shell Actor 2, Type: Opportunistic Threat Actor, Indicators: {'ip_addresses': ['118.99.141.178'], 'compromised_infrastructure': ['QNAP', 'DrayTek (vulnerable to CVE-2023-47218)']}, Name: Automated Scanning Operators, Type: Reconnaissance, Indicators: {'services': ['Nuclei scanner', 'oast.fun OAST probes'], 'ip_addresses': ['18.228.3.224'], 'commands': ['cat /etc/passwd', 'id', 'whoami']}, Name: Unknown Payload Hosting Group, Type: Infrastructure Operator, Indicators: {'ip_addresses': ['185.142.33.151', '90.156.218.31', '172.206.196.45']}.

Motivation: Financial Gain (Cryptojacking)Botnet ExpansionPersistence/Access BrokerageReconnaissancePotential Data Theft

Incident : Vulnerability Exploitation XWI2092520103125

Entity Type: Organizations using XWiki Platform

Incident : Vulnerability Exploitation XWI0133201111725

Entity Name: XWiki Project

Entity Type: Open-Source Software

Industry: Collaboration Platforms

Location: Global

Customers Affected: Unknown (all unpatched XWiki instances)

Incident : Vulnerability Exploitation XWI0133201111725

Entity Name: Organizations using XWiki

Entity Type: Corporations, Government Agencies, Educational Institutions

Industry: Multiple

Location: Global

Incident : Vulnerability Exploitation XWI2092520103125

Third Party Assistance: Xwiki Support For Patch Availability Information.

Containment Measures: Discontinue XWiki Platform usage if patching is not feasibleNetwork segmentation to restrict lateral movement

Remediation Measures: Immediate implementation of vendor-supplied security patchesInventory all XWiki Platform deployments (development, testing, production)Establish patch testing procedures before enterprise-wide rollout

Network Segmentation: Recommended to restrict lateral movement

Incident : Vulnerability Exploitation XWI0133201111725

Third Party Assistance: Vulncheck (Early Detection Via Canary Intelligence).

Containment Measures: CISA KEV catalog addition (2025-10-30)Public advisories

Remediation Measures: Urgent patching of XWiki instances

Communication Strategy: Security researcher reportsCISA KEV listing

Enhanced Monitoring: Recommended for XWiki servers (e.g., detecting /etc/passwd access attempts)

Incident : Vulnerability Exploitation XWI2092520103125

Data Exfiltration: Potential risk if exploited

Incident : Vulnerability Exploitation XWI0133201111725

File Types Exposed: /etc/passwd (attempted access)

Incident : Vulnerability Exploitation XWI2092520103125

Regulatory Notifications: CISA Binding Operational Directive (BOD) 22-01 for vulnerability management in cloud services

Incident : Vulnerability Exploitation XWI0133201111725

Regulatory Notifications: CISA KEV catalog inclusion (2025-10-30)

Incident : Vulnerability Exploitation XWI2092520103125

Lessons Learned: Critical vulnerabilities in open-source platforms with guest access can be weaponized by threat actors with low complexity., Immediate patching or discontinuation of vulnerable software is essential when exploitation risk is high., Network segmentation and inventory management are critical defensive measures during vulnerability windows.

Incident : Vulnerability Exploitation XWI0133201111725

Lessons Learned: Rapid weaponization of vulnerabilities (days between disclosure and widespread exploitation), Importance of early detection systems (e.g., VulnCheck Canary Intelligence), Need for accelerated patching timelines for critical vulnerabilities, Threat actors leverage compromised infrastructure (e.g., QNAP/DrayTek devices) for follow-on attacks, Diverse motivations (botnets, cryptojacking, reconnaissance) require multi-layered defenses

Incident : Vulnerability Exploitation XWI2092520103125

Recommendations: Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.Inventory all XWiki Platform deployments across development, testing, and production environments., Immediately apply vendor-supplied security patches or discontinue use if patching is not feasible., Implement network segmentation to limit lateral movement in case of exploitation., Monitor CISA advisories for newly disclosed vulnerabilities to proactively mitigate risks., Establish patch testing procedures before enterprise-wide rollout to avoid operational disruptions., Contact XWiki support for patch availability and guidance.

Incident : Vulnerability Exploitation XWI0133201111725

Recommendations: Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)Immediate patching of XWiki instances to CVE-2025-24893, Monitor for indicators of compromise (IOCs) such as RondoDox User-Agent patterns and known malicious IPs, Deploy network segmentation to limit lateral movement, Enhance logging for XWiki servers to detect exploitation attempts (e.g., /etc/passwd access), Block known malicious IPs at perimeter firewalls, Conduct threat hunting for reverse shells and cryptominers, Review AWS and other cloud environments for unauthorized netcat/BusyBox usage, Educate teams on the rapid evolution of exploitation (from single actors to botnets within a week)

Incident : Vulnerability Exploitation XWI2092520103125

Source: CISA Known Exploited Vulnerabilities Catalog

Incident : Vulnerability Exploitation XWI2092520103125

Source: CISA Binding Operational Directive (BOD) 22-01

Incident : Vulnerability Exploitation XWI0133201111725

Source: VulnCheck Research Report

Incident : Vulnerability Exploitation XWI0133201111725

Source: CISA Known Exploited Vulnerabilities Catalog

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Incident : Vulnerability Exploitation XWI0133201111725

Source: Security Telemetry Data (RondoDox, Cryptomining, Reverse Shells)

Incident : Vulnerability Exploitation XWI2092520103125

Investigation Status: Ongoing (CISA advisory issued, no active exploitation documented yet)

Incident : Vulnerability Exploitation XWI0133201111725

Investigation Status: Ongoing (active exploitation as of November 2025)

Incident : Vulnerability Exploitation XWI2092520103125

Stakeholder Advisories: Cisa Mandates Remediation By November 20, 2025.

Customer Advisories: Organizations using XWiki Platform urged to patch immediately or discontinue use

Incident : Vulnerability Exploitation XWI0133201111725

Stakeholder Advisories: Cisa Kev Advisory, Security Researcher Warnings.

Customer Advisories: XWiki project patch notifications

Incident : Vulnerability Exploitation XWI2092520103125

Entry Point: Xwiki Platform Solrsearch Component Via Eval Injection,

Backdoors Established: ['Potential if exploited']

High Value Targets: Organizational Data, Web Server Process Privileges,

Data Sold on Dark Web: Organizational Data, Web Server Process Privileges,

Incident : Vulnerability Exploitation XWI0133201111725

Entry Point: CVE-2025-24893 (XWiki RCE)

Reconnaissance Period: October 28, 2025 – November 2025 (ongoing)

Backdoors Established: ['Reverse shells (e.g., via BusyBox netcat)', 'Persistence mechanisms from cryptomining payloads']

High Value Targets: Xwiki Servers With Internet Exposure, Systems With Weak Credential Hygiene,

Data Sold on Dark Web: Xwiki Servers With Internet Exposure, Systems With Weak Credential Hygiene,

Incident : Vulnerability Exploitation XWI2092520103125

Root Causes: Improper Neutralization Of Directives In Dynamically Evaluated Code (Cwe-95), Improper Handling Of Eval Functions In Solrsearch Component, Guest User Access Model Creating Exploitable Trust,

Corrective Actions: Apply Security Patches, Discontinue Use If Patching Is Not Feasible, Implement Network Segmentation, Enhance Monitoring For Suspicious Activity,

Incident : Vulnerability Exploitation XWI0133201111725

Root Causes: Delayed Patching Of Critical Vulnerability, Lack Of Early Detection For Exploitation Attempts, Exposed Management Interfaces (E.G., Qnap/Draytek) Used As Launchpads, Automated Scanning Tools (E.G., Nuclei) Lowering The Barrier For Attackers,

Corrective Actions: Accelerate Vulnerability Disclosure-To-Patch Timelines, Improve Threat Intelligence Sharing For Emerging Exploits, Enhance Detection Capabilities For Post-Exploitation Activity (E.G., Reverse Shells), Hardening Of Internet-Exposed Systems To Prevent Lateral Movement,