CVE-2025-5389

Executive Summary

CVE-2025-5389 is a critical improper access control vulnerability in JeeWMS, an open-source Warehouse Management System. The flaw resides in the dogenerateOne2Many function within the /generateController.do?dogenerateOne2Many endpoint, which handles file generation operations. Due to missing or insufficient authorization checks, an unauthenticated remote attacker can invoke this endpoint to perform unauthorized actions, potentially leading to data exfiltration, file manipulation, or system compromise. The vendor uses a continuous delivery model with rolling releases, making it difficult to pinpoint a specific affected version; however, all versions up to 20250504 are considered vulnerable. No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the critical CVSS score and the lack of a formal patch.

Supply Chain & Package Security

JeeWMS is a Java-based web application typically deployed as a WAR file or Docker container. While not distributed via public package registries (NPM, PyPI, Go, Ruby), its dependencies (e.g., Spring Framework, Apache Tomcat) may introduce additional risks. Organizations using JeeWMS should verify the integrity of their deployment artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable remotely without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerable endpoint /generateController.do?dogenerateOne2Many is part of JeeWMS's code generation module, which is used to automatically create CRUD (Create, Read, Update, Delete) code for database tables. The dogenerateOne2Many function is designed to generate code for one-to-many relationships between entities.

Root Cause: The controller method lacks proper access control annotations (e.g., @PreAuthorize, @Secured, or role-based checks). In a typical Spring MVC application, this would be enforced via security configuration or method-level security. Without these checks, any unauthenticated request to the endpoint is processed.

Attack Flow:

1. Attacker identifies a JeeWMS instance (e.g., via Shodan or Google dorking).
2. Attacker sends a crafted HTTP GET request to /generateController.do?dogenerateOne2Many with parameters that trigger code generation or file operations.
3. The server executes the request with the privileges of the application user (often root or a high-privilege service account).
4. Depending on the implementation, the attacker may be able to:
   • Generate arbitrary files on the server (leading to remote code execution if a JSP or other executable file is created).
   • Read sensitive files (if the function outputs file contents).
   • Modify application configuration or data.

Technical Details:

• The endpoint is mapped in a Spring Controller (likely GenerateController.java).
• The dogenerateOne2Many method accepts parameters such as table names, package names, and output paths.
• Without input validation and access control, an attacker can manipulate these parameters to write files outside the intended directory.

Vulnerable vs. Patched Code

Since no official patch is available, the following represents a hypothetical secure implementation.

Vulnerable Code (Java/Spring):

@Controller
public class GenerateController {
    @RequestMapping("/generateController.do")
    public void dogenerateOne2Many(HttpServletRequest request, HttpServletResponse response) {
        // No authentication or authorization check
        String tableName = request.getParameter("tableName");
        String outputPath = request.getParameter("outputPath");
        // ... generate code and write files
    }
}

Patched Code (Hypothetical):

@Controller
@PreAuthorize("hasRole('ADMIN')")
public class GenerateController {
    @RequestMapping("/generateController.do")
    public void dogenerateOne2Many(HttpServletRequest request, HttpServletResponse response) {
        // Authentication and authorization enforced by Spring Security
        String tableName = request.getParameter("tableName");
        String outputPath = request.getParameter("outputPath");
        // Validate input parameters
        if (!isValidPath(outputPath)) {
            throw new SecurityException("Invalid output path");
        }
        // ... generate code and write files
    }
}

Key Differences:

• The patched version uses @PreAuthorize to restrict access to admin users.
• Input validation is added to prevent path traversal or arbitrary file writes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable JeeWMS instance (version up to 20250504).
• Network access to the target.

Exploitation Steps:

1. Reconnaissance: Use Shodan or Google dorks to find exposed JeeWMS instances.

   http.generateController.do
   

2. Craft Exploit Request: Send a GET request to the vulnerable endpoint with malicious parameters.

   curl -v "http://target:8080/generateController.do?dogenerateOne2Many&tableName=users&outputPath=../../webapps/ROOT/shell.jsp"
   

3. Verify Exploitation: Check if the file was created.

   curl "http://target:8080/shell.jsp"
   

4. Post-Exploitation: If successful, upload a web shell or execute commands.

Note: No public exploit code is available; the above is a conceptual example.

Blue Team

Detection:

• Monitor HTTP access logs for requests to /generateController.do with unusual parameters (e.g., outputPath containing ../).
• Alert on any file creation in unexpected directories (e.g., web root, /tmp).

Hunting:

• Search for files with suspicious extensions (.jsp, .php, .war) created around the time of the request.
• Review application logs for stack traces related to file I/O operations.

Containment:

• Immediately block the vulnerable endpoint at the web application firewall (WAF) or reverse proxy.
• Restrict network access to the JeeWMS application to trusted IPs only.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /generateController.do?dogenerateOne2Many with parameters like tableName, outputPath, packageName.
  • Outbound connections from the JeeWMS server to unknown IPs (if a web shell is uploaded).
• File System:
  • Unexpected files in the web application directory (e.g., shell.jsp, cmd.jsp).
  • Files with timestamps matching the exploitation time.
• Logs:
  • Application logs showing FileNotFoundException or IOException in GenerateController.
  • Access logs with 200 responses to the vulnerable endpoint from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_5389_JeeWMS_AccessControl {
    meta:
        description = "Detects exploitation attempts of CVE-2025-5389 in JeeWMS"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5389"
    strings:
        $s1 = "/generateController.do?dogenerateOne2Many" ascii wide nocase
        $s2 = "outputPath" ascii wide nocase
        $s3 = "../" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-5389 JeeWMS Improper Access Control
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests targeting the vulnerable JeeWMS endpoint
author: Valters IT
date: 2025-05-05
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/generateController.do?dogenerateOne2Many'
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5389 JeeWMS Improper Access Control Attempt"; flow:to_server; content:"/generateController.do?dogenerateOne2Many"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Endpoint: If possible, remove or comment out the dogenerateOne2Many mapping in the source code and redeploy.
2. Apply Access Controls: Implement authentication and authorization checks (e.g., Spring Security @PreAuthorize) for all controller methods.
3. Input Validation: Sanitize and validate all parameters, especially file paths, to prevent path traversal.

Long-Term Fix:

• Since the vendor uses rolling releases, monitor the official JeeWMS repository for a fix. If none is forthcoming, consider forking the project and applying the patch yourself.
• Upgrade to the latest rolling release (post-20250504) if available.

Compensating Controls:

• Deploy a WAF rule to block requests containing /generateController.do?dogenerateOne2Many.
• Restrict network access to the JeeWMS application using a firewall or VPN.
• Run the application with the least privileges necessary (e.g., not as root).

Valters IT
DevSecOps & Cyber Threat Intelligence