CVE-2025-7785
📋 TL;DR
This CVE describes an open redirect vulnerability in JeeSite's SSO controller that allows attackers to redirect users to malicious websites. The vulnerability affects JeeSite versions up to 5.12.0 and can be exploited remotely without authentication.
💻 Affected Systems
- thinkgem JeeSite
📦 What is this software?
Jeesite by Jeesite
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers use the redirect for phishing campaigns, tricking users into visiting malicious sites that appear legitimate.
If Mitigated
With proper input validation and URL whitelisting, the redirect would be blocked or validated before execution.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 3d06b8d009d0267f0255acc87ea19d29d07cedc3
Vendor Advisory: https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3
Restart Required: Yes
Instructions:
1. Update to the latest JeeSite version or apply commit 3d06b8d009d0267f0255acc87ea19d29d07cedc3. 2. Restart the application server. 3. Verify the fix by testing redirect functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to only allow redirects to trusted domains
Implement custom filter in web.xml or Spring Security configuration to validate redirect URLs
Disable SSO Redirect Parameter
allTemporarily disable or restrict the redirect parameter functionality
Modify SsoController.java to remove or hardcode redirect parameter
🧯 If You Can't Patch
- Implement WAF rules to block malicious redirect URLs
- Deploy network monitoring to detect suspicious redirect patterns
🔍 How to Verify
Check if Vulnerable:
Test the SSO endpoint with a malicious redirect parameter (e.g., ?redirect=http://evil.com) and check if it redirectsCheck Version:
Check pom.xml or application properties for JeeSite version, or use: java -jar your-app.jar --versionVerify Fix Applied:
After patching, test the same malicious redirect parameter - it should be blocked or validated📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in access logs
- Requests with external domains in redirect parameters
Network Indicators:
- HTTP 302 redirects to unexpected external domains
- Suspicious referrer patterns
SIEM Query:
http.status_code=302 AND url.query CONTAINS "redirect=" AND NOT url.destination IN (trusted_domains)🔗 References
- https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3
- https://github.com/thinkgem/jeesite5/issues/29
- https://github.com/thinkgem/jeesite5/issues/29#issue-3209433725
- https://github.com/thinkgem/jeesite5/issues/29#issuecomment-3045862084
- https://vuldb.com/?ctiid.316846
- https://vuldb.com/?id.316846
- https://vuldb.com/?submit.616104
- https://github.com/thinkgem/jeesite5/issues/29
- https://github.com/thinkgem/jeesite5/issues/29#issue-3209433725
- https://github.com/thinkgem/jeesite5/issues/29#issuecomment-3045862084
