CVE-2025-12305

Executive Summary

CVE-2025-12305 is a deserialization vulnerability in the quequnlong/shii-blog application, specifically within the SysJobController.java file. The flaw allows a remote attacker with low-level privileges to manipulate serialized data, leading to potential unauthorized actions. With a public exploit available and no official patch, this vulnerability poses a significant risk to organizations using the affected versions (up to 1.2.1).

Technical Analysis

The vulnerability is classified as CWE-20 (Improper Input Validation) and resides in src/main/java/com/mojian/controller/SysJobController.java under the Job Handler component. The core issue is that the application accepts serialized data from user input and deserializes it without adequate validation. Deserialization of untrusted data can allow an attacker to manipulate the object graph, potentially leading to remote code execution (RCE) if gadget chains are present in the application's classpath. However, the CVSS impact is limited to Low for Confidentiality, Integrity, and Availability, suggesting that while exploitation is feasible, the immediate impact may be constrained. The attack vector is network-accessible (AV:N) and requires low privileges (PR:L), indicating that an authenticated user could trigger the flaw. No specific function names, endpoints, or payload details are provided in the NVD description; therefore, the exact mechanism of deserialization remains unclear, but it likely involves HTTP requests carrying serialized Java objects or similar data structures.

Exploitation Scenarios

Given the public exploit availability and lack of technical specifics from the NVD description, the attack chain is inferred at the vulnerability-class level:

1. Reconnaissance: The attacker identifies a target running quequnlong shiyi-blog version 1.2.1 or earlier by checking for the application's login page or known endpoints.
2. Authentication: Since PR:L is required, the attacker must obtain valid low-privileged credentials, possibly through default accounts, credential stuffing, or social engineering.
3. Trigger Deserialization: The attacker sends a crafted request to the Job Handler component (likely via the SysJobController endpoint) containing malicious serialized data. The application deserializes this data without validation.
4. Payload Execution: Depending on available gadget chains, this could lead to arbitrary code execution, file manipulation, or unauthorized access to sensitive data. The CVSS impact indicates limited scope, so the attacker may achieve partial compromise.
5. Post-Exploitation: The attacker could use the initial foothold to escalate privileges, persist, or exfiltrate data, though the Low impact suggests constrained damage.

No public PoC details are available beyond the fact that an exploit exists; thus, the exact payload structure is unknown. Organizations should assume that an attacker can craft serialized objects to abuse the deserialization process.

Impact Assessment

The CVSS score of 6.3 (Medium) reflects partial technical impact: Confidentiality, Integrity, and Availability are each rated Low. This means a successful exploit could allow an attacker to read limited data, modify some information, or cause minor disruptions, but not total system compromise. The attack is remotely exploitable over the network, requiring low privileges, which increases the attack surface for authenticated users. The blast radius is confined to the application itself; lateral movement to underlying infrastructure is possible if the deserialization leads to RCE, but the Low impact scores suggest that such escalation is not guaranteed. Business impact includes potential data leakage, unauthorized job manipulation, and reputational damage. Given the public exploit, the likelihood of exploitation is elevated despite the EPSS score of 0.00512 (41.8th percentile), indicating that while not currently trending, the vulnerability is attractive to attackers due to its ease of use.

Detection Guidance

Sigma Rule

title: Detect Deserialization Attempts in Quequnlong Shiyi-Blog
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects potential deserialization attacks targeting SysJobController.java
author: Threat Intelligence Team
date: 2025-04-08
logsource:
  category: webserver
  product: java
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/sysJob'
    cs-uri-query|contains: 'job'
  condition: selection
falsepositives:
  - Legitimate job scheduling operations
level: high

YARA Rule

rule CVE_2025_12305_Deserialization
{
    meta:
        description = "Detects serialized Java objects in HTTP requests targeting shiyi-blog"
        author = "Threat Intelligence Team"
        date = "2025-04-08"
        reference = "CVE-2025-12305"
    strings:
        $java_magic = { AC ED 00 05 }
        $class_name = "com.mojian.controller.SysJobController"
    condition:
        $java_magic at 0 and $class_name
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-12305 Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/sysJob"; http_uri; content:"|AC ED 00 05|"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic Detection

sequence by host.id
  [network where network.protocol == "http" and http.request.method == "POST" and url.path contains "/sysJob"]
  [file where file.extension == "java" and file.name == "SysJobController.java"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*sysJob*" 
| eval deserialization_attempt=if(match(_raw, "AC ED 00 05"), "true", "false")
| where deserialization_attempt="true"
| table _time, src_ip, uri_path, status, deserialization_attempt

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/sysJob</field>
    <field name="method">POST</field>
    <regex>AC ED 00 05</regex>
    <description>CVE-2025-12305: Possible deserialization attack in shiyi-blog</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:
   • Implement input validation and sanitization for all serialized data received by the SysJobController.
   • Use a deserialization filter (e.g., Java's ObjectInputFilter) to restrict classes that can be deserialized.
   • Monitor logs for suspicious POST requests to job-related endpoints, especially those containing serialized Java objects.
   • Restrict network access to the application to trusted IPs and require strong authentication for all users.
2. Patch/Upgrade Steps:
   • No official patch is available. Monitor the vendor's repository (github.com/quequnlong/shiyi-blog) for updates.
   • If a patched version is released, upgrade immediately.
   • In the absence of a patch, consider disabling the vulnerable component if not essential.
3. Long-Term Hardening:
   • Adopt secure coding practices: never deserialize untrusted data.
   • Use serialization alternatives like JSON with strict schema validation.
   • Conduct regular security audits and penetration testing on custom applications.
   • Implement runtime application self-protection (RASP) or a web application firewall (WAF) with rules to detect deserialization attacks.

References

1. NVD – CVE-2025-12305: https://nvd.nist.gov/vuln/detail/CVE-2025-12305
2. GitHub Repository – quequnlong/shiyi-blog: https://github.com/quequnlong/shiyi-blog
3. CWE-20: Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
4. OWASP Deserialization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
5. EPSS Score for CVE-2025-12305: https://www.first.org/epss/articles/CVE-2025-12305

No known threat actor campaigns or exploit-in-the-wild evidence beyond the public exploit availability have been identified at this time.