CVE-2025-51746
📋 TL;DR
CVE-2025-51746 is a critical deserialization vulnerability in jishenghua JSH_ERP 2.3.1 that allows remote code execution via the /serialNumber/addSerialNumber endpoint. Attackers can exploit fastjson deserialization to execute arbitrary code on affected systems. All organizations running JSH_ERP 2.3.1 are affected.
💻 Affected Systems
- jishenghua JSH_ERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, and complete control over the ERP system and underlying server.
Likely Case
Remote code execution allowing attackers to steal sensitive business data, deploy backdoors, and pivot to other internal systems.
If Mitigated
Limited impact if endpoint is blocked, but still significant risk if any access remains.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable by attackers with minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/jishenghua/JSH_ERP
Restart Required: Yes
Instructions:
1. Monitor the official repository for security updates. 2. Apply any available patches immediately. 3. Restart the JSH_ERP application after patching.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allUse web application firewall or reverse proxy to block access to /serialNumber/addSerialNumber endpoint
# Example nginx location block
location /serialNumber/addSerialNumber { deny all; }
# Example Apache .htaccess
RewriteRule ^serialNumber/addSerialNumber - [F]
Network Segmentation
linuxIsolate JSH_ERP system from internet and restrict internal access
# Firewall rule to restrict access
# iptables -A INPUT -p tcp --dport [JSH_PORT] -s [TRUSTED_IPS] -j ACCEPT
# iptables -A INPUT -p tcp --dport [JSH_PORT] -j DROP
🧯 If You Can't Patch
- Immediately isolate the JSH_ERP system from all network access
- Implement strict network monitoring and alerting for any attempts to access the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if JSH_ERP version is 2.3.1 and the /serialNumber/addSerialNumber endpoint is accessible without authenticationCheck Version:
Check application configuration files or web interface for version informationVerify Fix Applied:
Verify that the vulnerable endpoint is no longer accessible or that the application has been updated to a patched version📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /serialNumber/addSerialNumber
- Unusual Java process execution
- Fastjson deserialization errors in application logs
Network Indicators:
- POST requests to /serialNumber/addSerialNumber with JSON payloads
- Outbound connections from JSH_ERP server to suspicious IPs
SIEM Query:
source="web_logs" AND uri="/serialNumber/addSerialNumber" AND method="POST"