CVE-2025-60801
📋 TL;DR
jshERP up to commit fbda24da contains an unauthenticated remote code execution vulnerability in the jsh_erp function. Attackers can execute arbitrary code on affected systems without authentication. This affects all deployments running vulnerable versions of jshERP.
💻 Affected Systems
- jshERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to other systems, or establish persistent access.
Likely Case
Attackers gain shell access to the server, potentially compromising the entire jshERP instance and any connected systems.
If Mitigated
Limited impact if network segmentation and strict access controls prevent lateral movement from the compromised system.
🎯 Exploit Status
The vulnerability is unauthenticated and public exploit details are available, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit fbda24da
Vendor Advisory: https://github.com/jishenghua/jshERP/issues/132
Restart Required: Yes
Instructions:
1. Update to the latest version of jshERP after commit fbda24da. 2. Restart the jshERP service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to jshERP to only trusted IP addresses or internal networks.
iptables -A INPUT -p tcp --dport [jshERP_port] -s [trusted_ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [jshERP_port] -j DROP
Web Application Firewall
allDeploy a WAF with rules to block RCE attempts targeting the jsh_erp function.
🧯 If You Can't Patch
- Isolate the jshERP system from critical networks and internet access.
- Implement strict network segmentation and monitor for unusual outbound connections.
🔍 How to Verify
Check if Vulnerable:
Check if your jshERP version is at or before commit fbda24da by examining the git commit history or version files.Check Version:
git log --oneline -1Verify Fix Applied:
Confirm the system is running a version after commit fbda24da and test that the jsh_erp function no longer accepts malicious input.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to jsh_erp function with shell commands
- Unexpected process execution from jshERP context
Network Indicators:
- Outbound connections from jshERP server to unknown IPs
- Unusual traffic patterns to/from jshERP port
SIEM Query:
source="jshERP" AND (url="*jsh_erp*" AND (cmd="*" OR shell="*" OR exec="*"))