CVE-2025-55367
📋 TL;DR
This vulnerability allows unauthorized attackers to modify supplier status information in jshERP v3.5 without proper authentication. It affects all users of jshERP v3.5 who haven't applied the patch. The flaw exists in the SupplierController.java component where access controls are improperly implemented.
💻 Affected Systems
- jshERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Attackers could disrupt supply chain operations by disabling critical suppliers, causing business disruption and financial loss.
Likely Case
Unauthorized modification of supplier status data leading to operational confusion and potential data integrity issues.
If Mitigated
With proper access controls, only authorized users can modify supplier status, maintaining data integrity.
🎯 Exploit Status
Exploitation requires understanding of the application's API endpoints but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.6 or later
Vendor Advisory: https://github.com/jishenghua/jshERP
Restart Required: No
Instructions:
1. Download latest version from official repository. 2. Backup current installation. 3. Replace affected SupplierController.java with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to jshERP application to trusted IPs only
Web Application Firewall Rules
allImplement WAF rules to block unauthorized supplier status modification requests
🧯 If You Can't Patch
- Implement strict network segmentation to isolate jshERP from untrusted networks
- Enable detailed logging and monitoring for supplier status modification attempts
🔍 How to Verify
Check if Vulnerable:
Check if running jshERP v3.5 and review SupplierController.java for missing authentication checks on status modification endpoints.Check Version:
Check application version in admin panel or review application.properties fileVerify Fix Applied:
Test supplier status modification without authentication - should be denied. Verify version is v3.6 or later.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST/PUT requests to supplier status endpoints
- Multiple failed authentication attempts followed by supplier status changes
Network Indicators:
- Unusual patterns of supplier status modification requests
- Requests to supplier endpoints from unexpected IP addresses
SIEM Query:
source="jshERP" AND (uri="/supplier/status" OR uri="/supplier/update") AND NOT user=authenticated_user