CVE-2025-60830
📋 TL;DR
Redragon ERP v1.0 contains a Shiro deserialization vulnerability due to the use of default Shiro cryptographic keys. This allows attackers to execute arbitrary code on affected systems by crafting malicious serialized objects. Organizations running Redragon ERP v1.0 are affected.
💻 Affected Systems
- redragon-erp
📦 What is this software?
Redragon Erp by Redragon Erp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthenticated remote code execution allowing attackers to gain shell access and deploy malware.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Requires knowledge of Shiro deserialization techniques and default key exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.1 or later
Vendor Advisory: https://github.com/Yyjccc/document/blob/main/redragon-erp/redragon-erp.md
Restart Required: Yes
Instructions:
1. Upgrade to Redragon ERP v1.1 or later. 2. Restart the application server. 3. Verify the Shiro configuration uses unique cryptographic keys.
🔧 Temporary Workarounds
Change Shiro cryptographic keys
allReplace default Shiro keys with unique, strong cryptographic keys
Modify shiro.ini or equivalent configuration file to set custom cipherKey and rememberMe.cipherKey
🧯 If You Can't Patch
- Implement strict network access controls to limit access to Redragon ERP
- Deploy WAF rules to block Shiro deserialization payloads
🔍 How to Verify
Check if Vulnerable:
Check if Redragon ERP v1.0 is installed and review Shiro configuration for default keysCheck Version:
Check application manifest or version file in installation directoryVerify Fix Applied:
Verify application version is v1.1+ and Shiro configuration uses custom cryptographic keys📡 Detection & Monitoring
Log Indicators:
- Java deserialization errors in application logs
- Unusual rememberMe cookie patterns
Network Indicators:
- HTTP requests with crafted rememberMe cookies
- Unusual outbound connections from application server
SIEM Query:
source="application.logs" AND ("deserialization" OR "rememberMe")