CVE-2025-67341
📋 TL;DR
jshERP versions 3.5 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows attackers to upload malicious PDF files containing XSS payloads. These files are accessible via static URLs, potentially exposing all users to script execution in their browsers. This affects all organizations using vulnerable jshERP installations.
💻 Affected Systems
- jshERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect users to malicious sites, or install malware through drive-by downloads.
Likely Case
Attackers with access to upload functionality could inject malicious scripts that execute when users view PDF files, potentially stealing credentials or session data.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before reaching users' browsers.
🎯 Exploit Status
Exploitation requires access to upload PDF files, which typically requires some level of authentication or access to vulnerable upload endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/jishenghua/jshERP/issues/139
Restart Required: No
Instructions:
1. Monitor the GitHub issue for official patches. 2. Apply any available updates from the vendor. 3. Test in a non-production environment first.
🔧 Temporary Workarounds
Disable PDF Uploads
allTemporarily disable PDF file upload functionality in jshERP
Implement Content Security Policy
allAdd Content-Security-Policy headers to restrict script execution
🧯 If You Can't Patch
- Implement strict file upload validation to block PDF files or sanitize content
- Configure web application firewall (WAF) rules to detect and block XSS payloads in file uploads
🔍 How to Verify
Check if Vulnerable:
Check if running jshERP version 3.5 or earlier and if PDF upload functionality existsCheck Version:
Check jshERP configuration files or admin interface for version informationVerify Fix Applied:
Test PDF upload functionality with XSS payloads to ensure scripts are not executed📡 Detection & Monitoring
Log Indicators:
- Unusual PDF file uploads
- Large number of PDF uploads from single user
- PDF files with suspicious names or content
Network Indicators:
- HTTP requests to static PDF URLs with suspicious parameters
- Upload requests containing script tags in file content
SIEM Query:
source="web_server" AND (uri_path="*.pdf" AND (user_agent="*script*" OR referer="*javascript*"))