CVE-2025-0390
📋 TL;DR
This critical path traversal vulnerability in Jeewms allows attackers to access arbitrary files on the server by manipulating the /wmOmNoticeHController.do endpoint. Attackers can exploit this remotely to read sensitive system files. All Jeewms installations up to version 20241229 are affected.
💻 Affected Systems
- Guangzhou Huayi Intelligent Technology Jeewms
📦 What is this software?
Jeewms by Huayi Tec
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or system files leading to further exploitation.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user information stored on the server.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Exploit details are publicly available; simple path traversal payloads can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20250101
Vendor Advisory: https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Download version 20250101 from official source. 3. Replace affected files. 4. Restart application server. 5. Verify fix.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing path traversal sequences to /wmOmNoticeHController.do
WAF specific - configure rule to block '../' patterns in URL parameters
Endpoint Restriction
linuxRestrict access to vulnerable endpoint using network controls
iptables -A INPUT -p tcp --dport [app_port] -m string --string '/wmOmNoticeHController.do' --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict file system permissions to limit accessible directories
- Deploy network segmentation to isolate Jeewms from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Test by sending request to /wmOmNoticeHController.do with '../' payloads and checking responseCheck Version:
Check application version in admin interface or configuration filesVerify Fix Applied:
Attempt same path traversal payloads after upgrade; should receive error or be blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wmOmNoticeHController.do containing '../' sequences
- Unusual file access patterns from web application
Network Indicators:
- Multiple requests with path traversal patterns to vulnerable endpoint
- Outbound connections from web server to unexpected internal systems
SIEM Query:
source="web_logs" AND uri="/wmOmNoticeHController.do" AND (uri="*../*" OR params="*../*")