CVE-2025-11139

Executive Summary

CVE-2025-11139 is a path traversal vulnerability in Bjskzy Zhiyou ERP up to version 11.0. The flaw exists in the com.artery.form.services.FormStudioUpdater component, specifically within the uploadStudioFile function. By manipulating the filepath argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially leading to arbitrary file read, write, or deletion. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts. The CVSS v3.1 base score is 6.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. No EPSS score or GitHub advisory is available. This vulnerability is not related to any WordPress plugin or component; it is a standalone ERP system.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited file read possible.
• Integrity (I): Low (L) – Limited file write possible.
• Availability (A): Low (L) – Limited file deletion possible.

Threat Level: Medium. The vulnerability is remotely exploitable without authentication, but the impact is limited to low-level file system manipulation. However, in an ERP context, this could lead to exposure of sensitive business data or configuration files.

Deep Dive & Mechanics

The vulnerability resides in the uploadStudioFile function of the FormStudioUpdater class. This function is designed to handle file uploads for form studio components. The filepath parameter is used to specify the destination path for the uploaded file. Due to insufficient validation, an attacker can supply a filepath containing directory traversal sequences (e.g., ../) to write files outside the intended upload directory.

The attack flow:

1. An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The request includes a filepath parameter with traversal sequences, such as ../../../../etc/passwd.
3. The application processes the request and writes the uploaded file to the attacker-specified location.
4. This can lead to arbitrary file write, which may be leveraged for remote code execution if the attacker can write a web shell or overwrite critical configuration files.

The exploit is publicly available, increasing the risk of active exploitation.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

// Vulnerable code (conceptual)
public void uploadStudioFile(String filepath, byte[] fileData) {
    File file = new File(filepath);
    // No validation of filepath
    FileOutputStream fos = new FileOutputStream(file);
    fos.write(fileData);
    fos.close();
}

A patched version would include validation:

// Patched code (conceptual)
public void uploadStudioFile(String filepath, byte[] fileData) {
    // Sanitize filepath to prevent traversal
    String sanitizedPath = filepath.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    File baseDir = new File("/safe/upload/directory");
    File file = new File(baseDir, sanitizedPath);
    // Ensure the file is within the base directory
    if (!file.getCanonicalPath().startsWith(baseDir.getCanonicalPath())) {
        throw new SecurityException("Invalid file path");
    }
    FileOutputStream fos = new FileOutputStream(file);
    fos.write(fileData);
    fos.close();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Bjskzy Zhiyou ERP v11.0 running on a local VM (e.g., Ubuntu 20.04 with Tomcat).
• Attacker: Kali Linux with Burp Suite or curl.

Exploit Steps:

1. Identify the vulnerable endpoint (likely /form/studio/upload or similar).
2. Craft a POST request with a manipulated filepath parameter.

curl -X POST http://target:8080/form/studio/upload \
  -F "filepath=../../../../tmp/evil.jsp" \
  -F "file=@/path/to/evil.jsp"

3. Verify the file was written to /tmp/evil.jsp.
4. For RCE, write a web shell to the web root (e.g., ../../webapps/ROOT/shell.jsp).

Expected Outcome: Arbitrary file write leading to potential RCE.

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP requests with filepath parameters containing ../ or ..\.
• Alert on file writes to unexpected directories (e.g., /etc, /tmp, web root).
• Use file integrity monitoring (FIM) to detect unauthorized file changes.

Response:

• Isolate the affected system.
• Review logs for suspicious file writes.
• Restore any modified files from backups.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /form/studio/upload or similar endpoints.
  • filepath parameter containing ../ or ..\ sequences.
  • Unusual file extensions in uploads (e.g., .jsp, .php, .exe).

• File System:

  • Unexpected files in /tmp, /etc, or web application directories.
  • New or modified files with suspicious names (e.g., shell.jsp, backdoor.php).

• Logs:

  • Application logs showing file writes to paths outside the intended upload directory.
  • Web server logs with 200 responses to upload requests with traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_11139_PathTraversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests targeting CVE-2025-11139"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11139"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/form/studio/upload"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-11139 Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting the vulnerable endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/form/studio/upload'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11139 Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/form/studio/upload"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network if possible.
2. Apply virtual patching using a WAF (e.g., ModSecurity) to block requests with ../ in the filepath parameter.
3. Disable the vulnerable endpoint if not required.

Long-term Fix:

• Since the vendor is unresponsive, consider migrating to a different ERP solution.
• If source code is available, implement proper input validation and canonical path checks as shown in the patched code example.
• Conduct a security audit of the entire application for similar vulnerabilities.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Expert System
CVE-2025-11139 | Bjskzy Zhiyou ERP Path Traversal
Date: 2025-04-10