RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-24893 | Unauthenticated RCE via Eval Injection in XWiki Platform SolrSearch XWiki Platform contains an eval injection flaw (CWE-95) that allows any unauthenticated guest user to execute arbitrary code on the hosting server. An attacker triggers the flaw by sending a crafted request to the platform's SolrSearch functionality, which evaluates attacker-controlled input without authentication. Successful exploitation yields arbitrary remote code execution with the privileges of the wiki application, potentially enabling full server compromise. Any deployment of XWiki Platform is affected, with internet-exposed wikis at the highest risk; the affected version ranges are not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-30, indicating confirmed in-the-wild exploitation (ransomware use unconfirmed), and EPSS assigns a ~99.9% probability of exploitation within 30 days. Do: Upgrade to a patched XWiki Platform release per the vendor's security advisory (fixed version numbers not provided in the available data); as interim mitigation, restrict untrusted access to the SolrSearch endpoint and review access logs for anomalous search requests and post-exploitation indicators such as unusual application-server child processes, new files, or webshells. The 2025-10-30 KEV listing makes remediation mandatory for U.S. federal agencies under BOD 22-01, and given the unauthenticated RCE with near-certain exploitation probability, internet-exposed wikis should be patched urgently. | 9.8 | 100% | KEV PoC |
| moderate≈1,000–10,000 internet-exposed XWiki instances (total deployments, including intranets, unknown) |
Full article353 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 15, 2025Malware / Vulnerability
The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attackers to achieve arbitrary code execution.
The vulnerability in question is CVE-2025-24893 (CVSS score: 9.8), an eval injection bug that could allow any guest user to perform arbitrary remote code execution through a request to the "/bin/get/Main/SolrSearch" endpoint. It was patched by the maintainers in XWiki 15.10.11, 16.4.1, and 16.5.0RC1 in late February 2025.
While there was evidence that the shortcoming had been exploited in the wild since at least March, it wasn't until late October, when VulnCheck disclosed it had observed fresh attempts weaponizing the flaw as part of a two-stage attack chain to deploy a cryptocurrency miner.
Subsequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply necessary mitigations by November 20.
In a fresh report published Friday, VulnCheck revealed that it has since observed a spike in exploitation attempts, hitting a new high on November 7, followed by another surge on November 11. This indicates broader scanning activity likely driven by multiple threat actors participating in the effort.
This includes RondoDox, a botnet that's rapidly adding new exploitation vectors to rope susceptible devices into a botnet for conducting distributed denial-of-service (DDoS) attacks using HTTP, UDP, and TCP protocols. The first RondoDox exploit was observed on November 3, 2025, per the cybersecurity company.
Other attacks have been observed exploiting the flaw to deliver cryptocurrency miners, as well as attempts to establish a reverse shell and general probing activity using a Nuclei template for CVE-2025-24893.
The findings once again illustrate the need for adopting robust patch management practices to ensure optimal protection.
"CVE-2025-24893 is a familiar story: one attacker moves first, and many follow," VulnCheck's Jacob Baines said. "Within days of the initial exploitation, we saw botnets, miners, and opportunistic scanners all adopting the same vulnerability."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/11/rondodox-exploits-unpatched-xwiki.html