CVE-2025-9795

Executive Summary

CVE-2025-9795 is an unrestricted file upload vulnerability in the xujeff tianti (天梯) application, affecting versions up to 2.3. The flaw resides in the ajaxUploadFile function within UploadController.java, allowing an attacker to upload arbitrary files without proper validation. This can lead to remote code execution, data exfiltration, or full server compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the ease of exploitation and potential for significant impact, though the exact impact depends on the server configuration and uploaded file type.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The ajaxUploadFile method in UploadController.java accepts a file via the upfile parameter and saves it to the server without checking the file type, content, or size. An attacker can upload a malicious script (e.g., JSP, PHP, or shell) and then access it via the web server to execute arbitrary commands.

The lack of validation means any file extension is accepted, and the file is stored in a predictable location (likely under the web root). This allows direct access and execution.

Vulnerable vs. Patched Code

Vulnerable Code (tianti <= 2.3):

// src/main/java/com/jeff/tianti/controller/UploadController.java
@PostMapping("/ajaxUploadFile")
public String ajaxUploadFile(@RequestParam("upfile") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String savePath = "/uploads/" + fileName;
    file.transferTo(new File(savePath));
    return "success";
}

Patched Code (Hypothetical):

// Patched version would include validation
@PostMapping("/ajaxUploadFile")
public String ajaxUploadFile(@RequestParam("upfile") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Validate file extension
    String extension = fileName.substring(fileName.lastIndexOf("."));
    if (!allowedExtensions.contains(extension)) {
        return "error: invalid file type";
    }
    // Sanitize filename
    String safeName = UUID.randomUUID().toString() + extension;
    String savePath = "/uploads/" + safeName;
    file.transferTo(new File(savePath));
    return "success";
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable instance of tianti (version 2.3) on a local server.
2. Craft Payload: Create a JSP webshell (e.g., shell.jsp) with command execution capabilities.
3. Upload: Send a POST request to /ajaxUploadFile with the file as upfile.

   curl -F "upfile=@shell.jsp" http://target/tianti/ajaxUploadFile
   

4. Execute: Access the uploaded file at http://target/tianti/uploads/shell.jsp and execute commands.

Blue Team

1. Monitor: Watch for unusual file uploads, especially with executable extensions (JSP, PHP, ASP, etc.).
2. Block: Implement WAF rules to block uploads of script files.
3. Audit: Check server logs for POST requests to /ajaxUploadFile with suspicious file names.

Indicators of Compromise (IOCs)

• File Paths: /uploads/*.jsp, /uploads/*.php, /uploads/*.asp
• Network: POST requests to /ajaxUploadFile with Content-Type: multipart/form-data
• Logs: Entries showing file uploads with non-image extensions
• Processes: Unexpected web shell processes (e.g., cmd.exe, /bin/sh)

Detection Engineering

YARA Rule

rule CVE_2025_9795_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2025-9795"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "ajaxUploadFile" ascii
        $s2 = "upfile" ascii
        $s3 = ".jsp" ascii nocase
        $s4 = ".php" ascii nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-9795 Unrestricted File Upload
id: cve-2025-9795-upload
status: experimental
description: Detects attempts to exploit unrestricted file upload in tianti
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/ajaxUploadFile'
        cs-uri-extension: '.jsp' or '.php' or '.asp'
    condition: selection
falsepositives:
    - Legitimate file uploads (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9795 Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"/ajaxUploadFile"; http_uri; content:"upfile"; http_client_body; fileext:".jsp" or fileext:".php" or fileext:".asp"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the upload functionality if not required. Restrict access to the /uploads directory via web server configuration (e.g., deny execution of scripts).
• Short-term: Implement file type validation (whitelist allowed extensions), rename uploaded files to random names, and store them outside the web root.
• Long-term: Apply a vendor patch when available. Consider migrating to a supported alternative.

Valters IT
Securing Digital Frontiers