CVE-2025-9264
📋 TL;DR
This vulnerability in Xuxueli xxl-job allows remote attackers to manipulate job ID parameters to improperly control resource identifiers, potentially enabling unauthorized job deletion or manipulation. It affects all deployments of xxl-job up to version 3.1.1. The exploit has been made public and could be used against internet-facing instances.
💻 Affected Systems
- Xuxueli xxl-job
📦 What is this software?
Xxl Job by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker could delete or manipulate scheduled jobs, causing service disruption, data loss, or unauthorized job execution.
Likely Case
Attackers with some access could delete or modify job configurations, disrupting scheduled tasks and business operations.
If Mitigated
With proper access controls and input validation, impact is limited to authorized users only.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues. Attack requires some level of access to the job management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.2 or later
Vendor Advisory: https://github.com/xuxueli/xxl-job/issues/3773
Restart Required: No
Instructions:
1. Upgrade xxl-job to version 3.1.2 or later. 2. Replace the vulnerable JobInfoController.java file. 3. Rebuild and redeploy the application.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation for job ID parameters to ensure proper format and authorization checks
Access Restriction
allRestrict network access to the xxl-job admin interface using firewall rules or network segmentation
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the job management interface
- Deploy a web application firewall (WAF) with rules to detect and block parameter manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check if running xxl-job version 3.1.1 or earlier. Review if /src/main/java/com/xxl/job/admin/controller/JobInfoController.java contains the vulnerable remove function.Check Version:
Check application version in admin interface or review pom.xml for version numberVerify Fix Applied:
Verify version is 3.1.2 or later. Check that JobInfoController.java includes proper input validation and authorization checks for the remove function.📡 Detection & Monitoring
Log Indicators:
- Unusual job deletion patterns
- Failed authorization attempts on job removal endpoints
- Multiple job ID manipulation attempts
Network Indicators:
- HTTP requests to job removal endpoints with unusual parameters
- Traffic patterns suggesting automated job manipulation
SIEM Query:
source="xxl-job" AND (uri="/jobinfo/remove" OR method="DELETE") AND status=200