CVE-2025-51742
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on JSH_ERP systems by exploiting a Fastjson deserialization flaw. Attackers can send specially crafted requests to the vulnerable endpoint to achieve remote code execution. All organizations running JSH_ERP 2.3.1 are affected.
💻 Affected Systems
- jishenghua JSH_ERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, lateral movement, ransomware deployment, and complete business disruption.
Likely Case
Attackers gain initial foothold, deploy backdoors, steal sensitive ERP data, and potentially pivot to other systems.
If Mitigated
Attack attempts are blocked at network perimeter, but successful exploitation still leads to application compromise.
🎯 Exploit Status
Public proof-of-concept code exists showing RCE via JDBC payloads. Exploitation requires only HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/jishenghua/JSH_ERP
Restart Required: No
Instructions:
1. Monitor the official Gitee repository for security updates. 2. Check if newer versions address the vulnerability. 3. Apply any available patches immediately.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allUse web application firewall or reverse proxy to block access to /material/getMaterialEnableSerialNumberList endpoint
# Example nginx location block
location /material/getMaterialEnableSerialNumberList { deny all; }
Input Validation Filter
allImplement input validation to reject suspicious parameters in search queries
# Implement in application code to validate search parameter
# Reject parameters containing special characters or known exploit patterns
🧯 If You Can't Patch
- Isolate JSH_ERP systems in a restricted network segment with no internet access
- Implement strict network access controls and monitor all traffic to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your system runs JSH_ERP version 2.3.1 and has the /material/getMaterialEnableSerialNumberList endpoint accessibleCheck Version:
Check application configuration files or database version tables for JSH_ERP version informationVerify Fix Applied:
Verify the endpoint is no longer accessible or that input validation prevents exploitation attempts📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /material/getMaterialEnableSerialNumberList with unusual parameters
- Java process spawning unexpected child processes
- Unusual database connection attempts
Network Indicators:
- HTTP POST requests to vulnerable endpoint with serialized payloads
- Outbound connections to suspicious IPs following exploitation
SIEM Query:
source="web_logs" AND uri="/material/getMaterialEnableSerialNumberList" AND (param="search" CONTAINS "jdbc:" OR param="search" CONTAINS "rmi:")