XWiki Remote Code Execution Flaw Actively Weaponized for Coinmining

The article reports a critical XWiki vulnerability, CVE-2025-24893, that is actively weaponised to deploy cryptocurrency mining malware on unpatched XWiki installations. According to the article, the attacks originate from Vietnam-based threat actors, using a sophisticated two-stage method beginning with unauthenticated remote template injection via XWiki’s SolrSearch endpoint.

A crafted request with URL-encoded parameters executes remote commands, and the first stage downloads a small bash script from a command-and-control server at 193.32.208[.]24, saved to the /tmp directory, with a second request about 20 minutes later triggering the staged downloader and full infection chain.

The downloaded scripts fetch two additional payloads that establish persistence and deploy the miner, with one script installing a miner called tcrond in a hidden directory and the other terminating competing miners while launching mining software configured to connect to c3pool[.]org. The mining malware is UPX-packed and uses anti-analysis techniques; researchers identified the primary attack infrastructure at IP 123.25.249[.]88, and VulnCheck added the vulnerability to their KEV database in March 2025. Organizations should update XWiki and monitor for indicators of compromise.