CVE-2025-9263
📋 TL;DR
This vulnerability in Xuxueli xxl-job allows attackers to manipulate jobGroup parameters to improperly access resources. It affects xxl-job versions up to 3.1.1 and can be exploited remotely without authentication. Organizations using vulnerable versions of this job scheduling framework are at risk.
💻 Affected Systems
- Xuxueli xxl-job
📦 What is this software?
Xxl Job by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to job execution logs and potentially sensitive job metadata, leading to information disclosure about scheduled tasks and their configurations.
Likely Case
Information disclosure of job execution details and system metadata through improper resource identifier control.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure to trusted networks only.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub issues. Attack can be launched remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.2 or later
Vendor Advisory: https://github.com/xuxueli/xxl-job/issues/3772
Restart Required: Yes
Instructions:
1. Upgrade xxl-job to version 3.1.2 or later. 2. Replace the vulnerable JobLogController.java file. 3. Restart the xxl-job-admin service. 4. Verify the fix by testing the getJobsByGroup endpoint.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to xxl-job-admin interface to trusted IP addresses only
Configure firewall rules to limit access to xxl-job port (default 8080) to authorized networks
Authentication Enforcement
allEnsure all xxl-job endpoints require proper authentication even if not default
Verify authentication is enabled in application.properties: xxl.job.login.username=admin, xxl.job.login.password=password
🧯 If You Can't Patch
- Implement strict network segmentation to isolate xxl-job instances from untrusted networks
- Enable comprehensive logging and monitoring of all access to JobLogController endpoints
🔍 How to Verify
Check if Vulnerable:
Check if running xxl-job version <= 3.1.1 by examining pom.xml or application startup logsCheck Version:
grep -i version pom.xml or check application startup logs for xxl-job versionVerify Fix Applied:
After upgrade, verify version is 3.1.2+ and test the getJobsByGroup endpoint with manipulated jobGroup parameters📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /joblog endpoints
- Multiple failed or unusual jobGroup parameter values in requests
Network Indicators:
- HTTP requests to /joblog/getJobsByGroup with abnormal jobGroup parameters
- Unusual traffic volume to xxl-job-admin interface
SIEM Query:
source="xxl-job" AND (uri_path="/joblog/getJobsByGroup" AND jobGroup!="expected_values")