CVE-2025-61188

Executive Summary

CVE-2025-61188 is a path traversal vulnerability affecting Jeecgboot versions 3.8.2 and earlier. The flaw allows an attacker to upload files with system-whitelisted extensions to the arbitrary system directory /opt, bypassing the intended restriction to the /opt/upFiles directory. This can lead to unauthorized file placement, potentially enabling remote code execution if the uploaded file is a script (e.g., JSP, PHP) that can be executed by the web server. The vulnerability has a CVSS score of 0.0 (placeholder) and no public exploit or patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

Jeecgboot is a Java-based rapid development framework. The vulnerability exists in the file upload functionality, which is a common attack vector in web applications. Since no patch is available, organizations using Jeecgboot should consider this a high-risk supply chain issue and apply strict access controls or disable file uploads until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual score not provided)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user with upload permissions
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H) – arbitrary file upload can lead to data exposure
• Integrity (I): High (H) – attacker can overwrite system files
• Availability (A): High (H) – could lead to denial of service or system compromise

Threat Level: Critical (if exploited, can lead to full system compromise)

Deep Dive & Mechanics

The vulnerability lies in the file upload handler of Jeecgboot. The application is designed to restrict uploaded files to the /opt/upFiles directory. However, due to insufficient path validation, an attacker can manipulate the file path (e.g., using ../ sequences) to write files to /opt or other arbitrary directories. The system only checks the file extension against a whitelist, but does not properly sanitize the directory path.

Attack Flow:

1. Attacker authenticates to the Jeecgboot application.
2. Attacker crafts a multipart HTTP request with a file upload, setting the filename to something like ../../opt/evil.jsp.
3. The server validates the file extension (e.g., .jsp) against the whitelist and accepts the upload.
4. The file is written to /opt/evil.jsp instead of /opt/upFiles/evil.jsp.
5. If the web server is configured to serve files from /opt, the attacker can access the uploaded JSP file and execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Jeecgboot <= 3.8.2):

// FileUploadController.java (simplified)
public String uploadFile(MultipartFile file) {
    String originalFilename = file.getOriginalFilename();
    String extension = originalFilename.substring(originalFilename.lastIndexOf("."));
    if (!whitelist.contains(extension)) {
        return "Extension not allowed";
    }
    String path = "/opt/upFiles/" + originalFilename; // No path sanitization
    file.transferTo(new File(path));
    return "Upload successful";
}

Patched Code (Hypothetical):

// FileUploadController.java (patched)
public String uploadFile(MultipartFile file) {
    String originalFilename = file.getOriginalFilename();
    String extension = originalFilename.substring(originalFilename.lastIndexOf("."));
    if (!whitelist.contains(extension)) {
        return "Extension not allowed";
    }
    // Sanitize filename to remove path traversal
    String safeFilename = new File(originalFilename).getName();
    String path = "/opt/upFiles/" + safeFilename;
    file.transferTo(new File(path));
    return "Upload successful";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Jeecgboot instance (version <= 3.8.2)
• Valid user credentials with file upload permissions

Exploit Steps:

1. Identify the file upload endpoint (e.g., /jeecg-boot/sys/file/upload).
2. Craft a malicious file (e.g., a JSP webshell) with a whitelisted extension.
3. Use a tool like curl to upload the file with a path traversal payload:

curl -X POST -F "file=@evil.jsp;filename=../../opt/evil.jsp" \
  -H "Cookie: JSESSIONID=your_session_id" \
  http://target.com/jeecg-boot/sys/file/upload

4. Access the uploaded file at http://target.com/opt/evil.jsp to execute commands.

Expected Result: The file is written to /opt/evil.jsp and can be accessed via the web server.

Blue Team (Defense)

Detection:

• Monitor file upload logs for suspicious filenames containing ../ or ..\.
• Alert on files written outside the intended upload directory (/opt/upFiles).
• Use file integrity monitoring (FIM) to detect new files in /opt.

Mitigation:

• Apply input validation to strip path traversal sequences from filenames.
• Use a secure file upload library that automatically sanitizes paths.
• Restrict web server access to only the /opt/upFiles directory.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Paths: /opt/evil.jsp, /opt/shell.jsp, /opt/cmd.jsp
• Network Traffic: HTTP POST requests to /jeecg-boot/sys/file/upload with filenames containing ../
• Log Entries: File upload logs showing paths like /opt/evil.jsp instead of /opt/upFiles/
• System Files: Unexpected files in /opt directory with .jsp, .php, or other executable extensions

Detection Engineering

YARA Rule

rule CVE_2025_61188_Path_Traversal_Upload {
    meta:
        description = "Detects path traversal attempts in file uploads targeting Jeecgboot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61188"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $upload_endpoint = /\/jeecg-boot\/sys\/file\/upload/
    condition:
        $upload_endpoint and $path_traversal
}

Sigma Rule

title: Jeecgboot Path Traversal File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with path traversal patterns in file uploads to Jeecgboot
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/jeecg-boot/sys/file/upload'
        cs-uri-query|re: '\.\.\/|\.\.\\'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61188 Jeecgboot Path Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/jeecg-boot/sys/file/upload"; http_uri; pcre:"/\.\.\/|\.\.\\/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not required.
2. Restrict the web server to only serve files from /opt/upFiles (e.g., using Apache Alias or Nginx alias).
3. Apply a WAF rule to block path traversal patterns in file upload requests.

Long-Term Fix:

• Upgrade to a patched version of Jeecgboot once available.
• Implement server-side filename sanitization using java.io.File.getName() or similar.
• Use a secure file upload library like Apache Commons FileUpload with proper path validation.

Workaround:

• Modify the application code to reject filenames containing ../ or ..\.
• Change the upload directory to a non-web-accessible location and serve files via a download script.

Valters IT