CVE-2025-7877
📋 TL;DR
This critical vulnerability in Metasoft MetaCRM allows remote attackers to upload arbitrary files via the sendfile.jsp endpoint. Affected systems include MetaCRM versions up to 6.4.2, potentially leading to complete system compromise.
💻 Affected Systems
- Metasoft MetaCRM
📦 What is this software?
Metacrm by Metasoft
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system takeover, data exfiltration, and lateral movement within the network
Likely Case
Webshell deployment allowing persistent backdoor access and data manipulation
If Mitigated
File upload attempts blocked at perimeter, limiting impact to failed attack attempts
🎯 Exploit Status
Public exploit code available on GitHub, simple file upload manipulation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to version above 6.4.2 if available or implementing workarounds.
🔧 Temporary Workarounds
Block sendfile.jsp access
allRestrict access to vulnerable endpoint via web server configuration
# Apache: RewriteRule ^/sendfile\.jsp$ - [F]
# Nginx: location ~ /sendfile\.jsp$ { deny all; }
Implement file upload validation
allAdd server-side validation for file uploads in MetaCRM
# Modify sendfile.jsp to validate file extensions and content
🧯 If You Can't Patch
- Implement WAF rules to block malicious file upload patterns
- Restrict network access to MetaCRM instances to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file via sendfile.jsp endpoint with arbitrary extensionCheck Version:
Check MetaCRM version in admin interface or application filesVerify Fix Applied:
Verify file upload restrictions are enforced and sendfile.jsp endpoint is properly secured📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /sendfile.jsp
- Upload of files with suspicious extensions (.jsp, .php, .exe)
Network Indicators:
- Unusual outbound connections from MetaCRM server
- File upload traffic to sendfile.jsp
SIEM Query:
source="web_server" AND (url="/sendfile.jsp" OR file_extension IN ("jsp", "php", "exe"))