CVE-2025-13250
📋 TL;DR
This vulnerability in WeiYe-Jing datax-web up to version 2.1.2 allows remote attackers to bypass access controls on job management functions (remove/update/pause/start/triggerJob). Attackers can manipulate job operations without proper authorization, potentially disrupting data synchronization workflows. Organizations using affected versions of datax-web are at risk.
💻 Affected Systems
- WeiYe-Jing datax-web
📦 What is this software?
Datax Web by Datax Web Project
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could delete, modify, pause, start, or trigger data synchronization jobs, leading to data corruption, service disruption, or unauthorized data access.
Likely Case
Attackers gain unauthorized control over job scheduling and execution, potentially disrupting ETL processes or accessing sensitive data.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to authorized job management functions only.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. Attack requires some level of access but bypasses authorization controls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: Yes
Instructions:
1. Monitor official datax-web repositories for security updates. 2. Upgrade to a patched version when available. 3. Restart datax-web services after patching.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to datax-web management interfaces to trusted IP addresses only.
iptables -A INPUT -p tcp --dport [datax-web-port] -s [trusted-ip-range] -j ACCEPT
iptables -A INPUT -p tcp --dport [datax-web-port] -j DROP
Authentication Enhancement
allImplement additional authentication layers or API gateways in front of datax-web.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate datax-web from untrusted networks
- Deploy web application firewall (WAF) rules to detect and block unauthorized job management requests
🔍 How to Verify
Check if Vulnerable:
Check datax-web version: grep -i version datax-web configuration files or web interface. If version is 2.1.2 or earlier, system is vulnerable.Check Version:
Check web interface or configuration files for version informationVerify Fix Applied:
After applying workarounds, test if unauthorized users can still access job management endpoints using tools like curl or Postman.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /job/* endpoints
- Job operations from unexpected IP addresses or users
Network Indicators:
- HTTP requests to job management endpoints without proper authentication headers
- Unusual job trigger patterns
SIEM Query:
source="datax-web" AND (uri_path="/job/remove" OR uri_path="/job/update" OR uri_path="/job/pause" OR uri_path="/job/start" OR uri_path="/job/triggerJob") AND NOT user="authorized_user"