CVE-2025-7875
📋 TL;DR
This critical vulnerability in Metasoft MetaCRM allows attackers to bypass authentication via the /debug.jsp endpoint, potentially gaining unauthorized access to the CRM system. It affects all MetaCRM installations up to version 6.4.2 that have the vulnerable endpoint accessible.
💻 Affected Systems
- Metasoft MetaCRM
📦 What is this software?
Metacrm by Metasoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access sensitive customer data, modify business records, or pivot to other systems.
Likely Case
Unauthorized access to CRM data including customer information, sales records, and business intelligence.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation.
🎯 Exploit Status
Public exploit details available on GitHub, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider upgrading to any version beyond 6.4.2 if available, or implement workarounds.
🔧 Temporary Workarounds
Block /debug.jsp Access
allRestrict access to the vulnerable endpoint using web server configuration or firewall rules.
# Apache: RewriteRule ^/debug\.jsp$ - [F,L]
# Nginx: location = /debug.jsp { deny all; }
# IIS: Add request filter for /debug.jsp
Remove debug.jsp File
allPhysically delete or rename the vulnerable file from the web application directory.
# Linux: rm /path/to/webapp/debug.jsp
# Windows: del C:\path\to\webapp\debug.jsp
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MetaCRM instances from untrusted networks
- Deploy web application firewall (WAF) with rules to block requests to /debug.jsp
🔍 How to Verify
Check if Vulnerable:
Attempt to access https://your-metacrm-instance/debug.jsp. If it returns content or doesn't return a 403/404 error, the system may be vulnerable.Check Version:
Check MetaCRM version through admin interface or application metadata files. No standard CLI command available.Verify Fix Applied:
After implementing workarounds, verify that accessing /debug.jsp returns appropriate error (403 Forbidden or 404 Not Found).📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /debug.jsp with successful (200) responses
- Unusual authentication attempts or successful logins from unexpected sources
Network Indicators:
- Outbound traffic from MetaCRM server to unexpected destinations
- Increased traffic to /debug.jsp endpoint
SIEM Query:
web.url = "*/debug.jsp" AND http.status = 200