CVE-2025-15084

Executive Summary

CVE-2025-15084 is a vulnerability in the youlaitech youlai-mall e-commerce platform, affecting versions 1.0.0 and 2.0.0. The flaw resides in the OrderController.java file within the mall-oms module, specifically in the orderService.payOrder function. This function lacks proper access controls, allowing an authenticated attacker with low privileges to manipulate order payment operations without authorization. The attack is remotely exploitable but requires high complexity due to the need for specific knowledge of the order processing flow. The CVSS score is 3.1 (Low), reflecting the limited impact on confidentiality (low) and no impact on integrity or availability. The exploit is publicly available, and the vendor has not responded to disclosure attempts, leaving the vulnerability unpatched.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level issue in a Java-based application. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires specific conditions or knowledge.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The high attack complexity and low impact reduce the immediate risk, but the public exploit and lack of patch increase long-term exposure.

Deep Dive & Mechanics

The vulnerability is an improper access control (CWE-284) in the OrderController.java file. The payOrder function processes payment requests for orders but does not verify that the authenticated user owns the order being paid. This allows a malicious user to manipulate payment status or trigger payment processing for orders belonging to other users.

Technical Details:

• File: mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java
• Function: orderService.payOrder
• Issue: The function likely accepts an order ID from the request without checking if the order belongs to the current user. An attacker can enumerate order IDs (e.g., sequential integers) and call the endpoint with a different user's order ID.
• Impact: The attacker could cause payment processing for another user's order, potentially leading to financial discrepancies or order fulfillment issues. However, the CVSS score indicates only low confidentiality impact, suggesting the attacker might gain insight into order status or payment details.

Attack Flow:

1. Attacker authenticates as a low-privileged user.
2. Attacker identifies or guesses order IDs (e.g., via enumeration or observation).
3. Attacker sends a POST request to the payment endpoint with the victim's order ID.
4. The system processes the payment without ownership verification, potentially altering the order state.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be:

// Vulnerable code (hypothetical based on description)
@PostMapping("/pay")
public Result payOrder(@RequestParam Long orderId) {
    // No ownership check
    orderService.payOrder(orderId);
    return Result.success();
}

A patched version would include an ownership verification:

// Patched code (hypothetical)
@PostMapping("/pay")
public Result payOrder(@RequestParam Long orderId, Principal principal) {
    Order order = orderService.getOrderById(orderId);
    if (!order.getUserId().equals(getCurrentUserId(principal))) {
        return Result.error("Access denied");
    }
    orderService.payOrder(orderId);
    return Result.success();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of youlai-mall 1.0.0 or 2.0.0.
• Valid user credentials (low-privileged account).
• Knowledge of an order ID belonging to another user.

Exploit Steps:

1. Log in to the application and obtain a session token.
2. Identify a target order ID (e.g., via API enumeration or observation).
3. Send a crafted request to the payment endpoint:

curl -X POST "http://target/mall-oms/order/pay" \
  -H "Authorization: Bearer <token>" \
  -d "orderId=12345"

4. Observe the response to confirm the payment was processed.

Expected Outcome: The attacker can trigger payment processing for orders they do not own.

Blue Team

Detection:

• Monitor for unusual patterns in payment API calls, especially from users who do not typically make payments.
• Log all payment requests with user ID and order ID for audit.
• Implement rate limiting on payment endpoints to slow enumeration.

Mitigation:

• Apply access control checks in the payOrder function.
• Use randomized order IDs to prevent enumeration.
• Require additional verification (e.g., OTP) for payment operations.

Indicators of Compromise (IOCs)

• Network: POST requests to /mall-oms/order/pay with orderId parameter from unauthorized users.
• Logs: Repeated payment attempts for different order IDs from the same user.
• Application: Orders with payment status changed without corresponding user action.

Detection Engineering

YARA Rule

rule CVE_2025_15084_AccessControl {
    meta:
        description = "Detects vulnerable code pattern in youlai-mall OrderController"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15084"
    strings:
        $s1 = "payOrder" ascii wide nocase
        $s2 = "orderService.payOrder" ascii wide nocase
        $s3 = "OrderController" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15084 - Unauthorized Payment Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit improper access control in youlai-mall payment endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/mall-oms/order/pay'
        cs-uri-query|contains: 'orderId='
    condition: selection
falsepositives:
    - Legitimate payment operations by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15084 - Unauthorized Payment Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/mall-oms/order/pay"; http.client_body; content:"orderId"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the payment endpoint if not critical, or restrict access via firewall rules.
2. Implement access control in the payOrder function to verify order ownership.
3. Apply input validation to ensure order IDs are valid and belong to the authenticated user.

Long-term Fix:

• Wait for the vendor to release a patch. Since no response was received, consider forking the repository and applying the fix manually.
• Upgrade to a newer version if available.

Workarounds:

• Use a Web Application Firewall (WAF) to block suspicious payment requests.
• Enable detailed logging and monitoring for the payment API.

Valters IT
Securing Digital Frontiers