CVE-2025-10091
📋 TL;DR
This vulnerability in Jinher OA allows attackers to perform XML External Entity (XXE) attacks through the XML Handler component. Remote exploitation can lead to sensitive data disclosure, server-side request forgery, or denial of service. All systems running Jinher OA version 1.2 or earlier are affected.
💻 Affected Systems
- Jinher OA
📦 What is this software?
Jinher Oa by Jinher
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through file read, SSRF to internal services, or denial of service via entity expansion attacks.
Likely Case
Sensitive file disclosure (configuration files, credentials) and internal network reconnaissance via SSRF.
If Mitigated
Limited impact with proper XML parser hardening and network segmentation.
🎯 Exploit Status
Exploit disclosed on GitHub. Simple XXE payloads can be used. No authentication required to access vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider upgrading to newer version if available.
🔧 Temporary Workarounds
Disable XXE in XML Parser
allConfigure XML parser to disable external entity processing
Modify application configuration to set: XmlReaderSettings.DtdProcessing = DtdProcessing.Prohibit
Set XmlResolver = null in XML parser configuration
Web Application Firewall Rules
allBlock XXE patterns at WAF/IPS level
Add WAF rule to block requests containing: <!DOCTYPE, <!ENTITY, SYSTEM, PUBLIC
🧯 If You Can't Patch
- Block access to /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx at network firewall or reverse proxy
- Implement strict input validation and sanitization for XML input parameters
🔍 How to Verify
Check if Vulnerable:
Send XXE test payload to: http://target/c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add with XML containing external entity referenceCheck Version:
Check application version in web interface or configuration files. Look for version 1.2 or earlier.Verify Fix Applied:
Test with same XXE payload - should receive error or no data disclosure. Verify XML parser settings disable external entities.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /XmlHttp.aspx with XML content
- XML parsing errors in application logs
- Unusual file read attempts from web server process
Network Indicators:
- HTTP POST/GET requests containing <!DOCTYPE or <!ENTITY strings
- Outbound connections from web server to internal services (SSRF)
SIEM Query:
web.url:*XmlHttp.aspx* AND (http.request_body:*<!DOCTYPE* OR http.request_body:*<!ENTITY*)