CVE-2025-51743
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on JSH_ERP systems through fastjson deserialization attacks targeting the /materialCategory/addMaterialCategory endpoint. Attackers can achieve remote code execution (RCE) without authentication, potentially compromising the entire ERP system. All organizations running vulnerable versions of JSH_ERP are affected.
💻 Affected Systems
- jishenghua JSH_ERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal sensitive data, deploy ransomware, pivot to other systems, and maintain persistent access.
Likely Case
Remote code execution leading to data theft, system manipulation, and potential lateral movement within the network.
If Mitigated
Attackers can still exploit the vulnerability but impact is limited by network segmentation, minimal privileges, and monitoring systems.
🎯 Exploit Status
Public proof-of-concept code is available, and exploitation requires only HTTP requests to the vulnerable endpoint with crafted payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/jishenghua/JSH_ERP
Restart Required: No
Instructions:
1. Monitor the official Gitee repository for security updates. 2. Check if newer versions address the vulnerability. 3. Apply any available patches immediately.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allUse web application firewall (WAF) or reverse proxy to block access to /materialCategory/addMaterialCategory endpoint.
# Example nginx location block
location /materialCategory/addMaterialCategory { deny all; }
# Example Apache .htaccess
RewriteRule ^materialCategory/addMaterialCategory - [F]
Network Segmentation
linuxIsolate JSH_ERP systems from internet and restrict access to trusted IP addresses only.
# Example iptables rule
sudo iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the JSH_ERP system
- Deploy a web application firewall (WAF) with rules to detect and block fastjson deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check if your JSH_ERP version is 2.3.1 or potentially earlier. Test by sending a crafted fastjson payload to http://[target]/materialCategory/addMaterialCategory and observing system behavior.Check Version:
Check the application's version information in the admin interface or configuration files. No standard command exists.Verify Fix Applied:
After applying workarounds, attempt to access the vulnerable endpoint and verify it's blocked. Test with the same payload to confirm exploitation is prevented.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /materialCategory/addMaterialCategory with JSON payloads containing suspicious patterns
- Unusual system processes spawned from the JSH_ERP application
- Error logs showing deserialization failures
Network Indicators:
- HTTP traffic to /materialCategory/addMaterialCategory endpoint with JSON payloads
- Outbound connections from JSH_ERP system to unexpected destinations
SIEM Query:
source="web_logs" AND uri="/materialCategory/addMaterialCategory" AND method="POST" AND (content_type="application/json" OR body CONTAINS "@type")