CVE-2025-51745
📋 TL;DR
CVE-2025-51745 is a critical deserialization vulnerability in jishenghua JSH_ERP 2.3.1 that allows remote code execution via the /role/addcan endpoint. Attackers can exploit this to execute arbitrary code on affected systems. Organizations running JSH_ERP 2.3.1 are affected.
💻 Affected Systems
- jishenghua JSH_ERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, and complete control of the ERP system and underlying server.
Likely Case
Remote code execution allowing attackers to install backdoors, steal sensitive business data, and pivot to other internal systems.
If Mitigated
Limited impact if endpoint is blocked or system is isolated, though risk remains if vulnerable code is accessible.
🎯 Exploit Status
Public proof-of-concept code exists, and fastjson deserialization vulnerabilities are well-known attack vectors with mature exploitation tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/jishenghua/JSH_ERP
Restart Required: No
Instructions:
No official patch available. Monitor the vendor's Gitee repository for updates and apply any security patches immediately when released.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or network controls to block access to /role/addcan endpoint
# Example for Apache: RewriteRule ^/role/addcan - [F,L]
# Example for Nginx: location ~ ^/role/addcan { deny all; }
Update fastjson library
allUpdate the fastjson library to a secure version if JSH_ERP allows library updates
# Check current fastjson version in JSH_ERP dependencies
# Update to fastjson 1.2.83 or later if compatible
🧯 If You Can't Patch
- Isolate JSH_ERP system in a restricted network segment with no internet access
- Implement strict network access controls and monitor all traffic to the /role/addcan endpoint
🔍 How to Verify
Check if Vulnerable:
Check if JSH_ERP version is 2.3.1 and the /role/addcan endpoint is accessible. Test with a safe deserialization payload if possible.Check Version:
Check JSH_ERP version in web interface or configuration files. Look for version information in /WEB-INF/ directories.Verify Fix Applied:
Verify that the /role/addcan endpoint is no longer accessible or properly validates input. Test with known exploit payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /role/addcan
- Java deserialization errors in application logs
- Unexpected Java class loading
Network Indicators:
- HTTP POST requests to /role/addcan with serialized data
- Outbound connections from JSH_ERP server to unknown IPs
SIEM Query:
source="jsh_erp_logs" AND (uri="/role/addcan" OR message="*deserialization*" OR message="*fastjson*")