CVE-2025-7874

Executive Summary

CVE-2025-7874 is a publicly disclosed information disclosure vulnerability affecting Metasoft 美特软件 MetaCRM versions up to 6.4.2. The flaw resides in the /env.jsp endpoint, which exposes sensitive environment variables and system configuration details without authentication. This allows remote attackers to gather intelligence about the underlying server infrastructure, potentially aiding in further attacks. The vendor has not responded to disclosure attempts, and no official patch is available. The vulnerability is classified as problematic with a CVSS score of 0.0 (likely due to incomplete scoring), but the practical risk is elevated due to the lack of authentication required and the public availability of exploit details.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary CRM application (MetaCRM) deployed on-premises. The supply chain risk is limited to the vendor's failure to provide a patch, leaving all installations of the affected versions vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned, likely placeholder)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of environment variables)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (due to information leakage aiding reconnaissance)

Deep Dive & Mechanics

The vulnerability is a classic case of sensitive information exposure via a debug or diagnostic endpoint. The /env.jsp file is a Java Server Page that typically displays system environment variables, Java runtime properties, and application server configuration. In MetaCRM, this page is accessible without authentication, allowing any remote attacker to retrieve:

• Server OS and architecture details
• Java version and runtime paths
• Database connection strings (if exposed)
• Application server paths and configurations
• User home directories and temporary file paths

This information can be used to tailor subsequent attacks, such as exploiting known vulnerabilities in the specific Java version or targeting database credentials if exposed.

Vulnerable vs. Patched Code

Vulnerable Code (MetaCRM <= 6.4.2): The /env.jsp file likely contains code similar to:

<%@ page import="java.util.*" %>
<html>
<body>
<h2>System Environment</h2>
<%
    Map<String, String> env = System.getenv();
    for (String key : env.keySet()) {
        out.println(key + ": " + env.get(key) + "<br/>");
    }
%>
<h2>Java Properties</h2>
<%
    Properties props = System.getProperties();
    for (Object key : props.keySet()) {
        out.println(key + ": " + props.get(key) + "<br/>");
    }
%>
</body>
</html>

Patched Code (Hypothetical): A patch would either remove the /env.jsp file entirely or add authentication checks:

<%@ page import="java.util.*" %>
<%
    // Authentication check
    if (session.getAttribute("user") == null) {
        response.sendRedirect("login.jsp");
        return;
    }
%>
<html>
<body>
<h2>System Environment</h2>
...
</body>
</html>

Since no official patch exists, users must implement their own mitigation (see Remediation).

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify target MetaCRM instance (e.g., http://target.com/crm/).
2. Access the vulnerable endpoint directly: http://target.com/crm/env.jsp.
3. The page will display environment variables and system properties.
4. Extract sensitive data such as JAVA_HOME, CATALINA_HOME, DB_URL, DB_USER, etc.

Example Request:

curl -v http://target.com/crm/env.jsp

Expected Output (truncated):

JAVA_HOME: /usr/lib/jvm/java-8-openjdk-amd64
CATALINA_HOME: /opt/tomcat
DB_URL: jdbc:mysql://localhost:3306/metacrm
DB_USER: root

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /env.jsp from external IPs.
2. Alert on any successful HTTP 200 response to /env.jsp from non-authenticated users.
3. Check for unusual outbound connections from the CRM server after such access.

Hunting Query (Splunk):

index=web_logs source="/var/log/tomcat/access_log*"
| search uri="/crm/env.jsp" status=200
| stats count by src_ip, user_agent, timestamp

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /env.jsp (case-sensitive)
  • Response containing System Environment or Java Properties headers
• File System:
  • Presence of /env.jsp file in the web application directory
• Logs:
  • Tomcat access log entries with "GET /crm/env.jsp HTTP/1.1" 200

Detection Engineering

YARA Rule

rule detect_metacrm_env_jsp {
    meta:
        description = "Detects MetaCRM /env.jsp information disclosure endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7874"
    strings:
        $s1 = "/env.jsp" ascii wide nocase
        $s2 = "System Environment" ascii wide nocase
        $s3 = "Java Properties" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: MetaCRM /env.jsp Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to MetaCRM /env.jsp endpoint which exposes environment variables
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-uri-query|contains: "/env.jsp"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative access (if authentication is added)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7874 MetaCRM /env.jsp Information Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/env.jsp"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove or rename the /env.jsp file from the web application directory.
2. Access Control: Implement authentication for all diagnostic endpoints using web server rules (e.g., Apache .htaccess or Tomcat web.xml).
3. Web Application Firewall (WAF): Block requests to /env.jsp using a WAF rule.
4. Network Segmentation: Ensure the CRM server is not directly exposed to the internet; use a reverse proxy with access controls.
5. Vendor Contact: Continue to pressure Metasoft for an official patch. Consider migrating to an alternative CRM if no patch is forthcoming.

Valters IT
DevSecOps & Cyber Threat Intelligence