CVE-2025-10816
📋 TL;DR
This is an XML External Entity (XXE) vulnerability in Jinher OA 2.0 that allows remote attackers to read arbitrary files from the server or potentially perform server-side request forgery. It affects organizations using Jinher OA 2.0 with the vulnerable XML handler component exposed. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Jinher OA
📦 What is this software?
Jinher Oa by Jinher
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file disclosure of sensitive data (passwords, configuration files) leading to lateral movement, data exfiltration, or further exploitation.
Likely Case
Unauthorized file system access allowing reading of sensitive files, potentially exposing credentials, configuration data, or internal information.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and input validation are in place to block XXE payloads.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Contact Jinher vendor for updates. Consider workarounds or upgrading to a newer version if available.
🔧 Temporary Workarounds
Disable XXE Processing
allConfigure the XML parser to disable external entity processing
Modify XML parser configuration to set features: javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING = true, http://apache.org/xml/features/disallow-doctype-decl = true
WAF Rule Implementation
allBlock XXE payload patterns at the web application firewall
Add WAF rules to detect and block patterns containing: <!DOCTYPE, <!ENTITY, SYSTEM, PUBLIC, %xxe;, file:///, http:// internal references
🧯 If You Can't Patch
- Block access to /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx at network perimeter
- Implement strict input validation and sanitization for XML input parameters
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with XXE payloads: curl -X GET 'http://target/c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add' --data '<?xml version="1.0"?><!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>'Check Version:
Check Jinher OA version in application interface or configuration filesVerify Fix Applied:
Retest with same XXE payloads after implementing workarounds - should return error or empty response instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx with XML payloads
- Log entries containing XXE-related strings: <!DOCTYPE, <!ENTITY, SYSTEM, file:///
Network Indicators:
- HTTP traffic to vulnerable endpoint with XML content in parameters
- Outbound connections from server following XXE exploitation
SIEM Query:
source="web_logs" AND (uri="/c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx" AND (content CONTAINS "<!DOCTYPE" OR content CONTAINS "<!ENTITY" OR content CONTAINS "SYSTEM"))