CVE-2025-9310
📋 TL;DR
This vulnerability exposes hard-coded credentials in the Druid component of yeqifu carRental software, allowing attackers to gain unauthorized access to the system. The vulnerability affects all versions up to commit 3fabb7eae93d209426638863980301d6f99866b3, and can be exploited remotely without authentication.
💻 Affected Systems
- yeqifu carRental
📦 What is this software?
Carrental by Carrental Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the Druid monitoring interface, potentially compromising the entire carRental application and accessing sensitive data.
Likely Case
Unauthorized access to Druid monitoring dashboard, allowing attackers to view system metrics, execute SQL queries, and potentially escalate privileges.
If Mitigated
Limited impact if Druid interface is properly firewalled and access controls are implemented, though credentials remain exposed in code.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub and vuldb.com. Attackers can use hard-coded credentials to bypass authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - product uses rolling releases
Vendor Advisory: None found
Restart Required: No
Instructions:
Update to the latest version after commit 3fabb7eae93d209426638863980301d6f99866b3. Check the project repository for security updates.
🔧 Temporary Workarounds
Restrict access to Druid endpoint
LinuxBlock external access to /carRental_war/druid/ using firewall rules or web server configuration
iptables -A INPUT -p tcp --dport 8080 -m string --string "/carRental_war/druid/" --algo bm -j DROP
Change Druid credentials
allModify the hard-coded credentials in the Druid configuration files
Edit druid.properties or similar configuration files to replace default credentials
🧯 If You Can't Patch
- Implement network segmentation to isolate the carRental application from untrusted networks
- Deploy a web application firewall (WAF) with rules to block access to the Druid endpoint
🔍 How to Verify
Check if Vulnerable:
Attempt to access /carRental_war/druid/login.html and check if default credentials work. Review the commit hash in your deployment.Check Version:
Check git log for commit history: git log --oneline | head -20Verify Fix Applied:
Verify that the Druid login page requires proper authentication and that hard-coded credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts to Druid endpoint
- Successful logins from unexpected IP addresses to /carRental_war/druid/
Network Indicators:
- HTTP requests to /carRental_war/druid/login.html from external IPs
- Multiple authentication attempts to Druid endpoint
SIEM Query:
source="web_server" AND (uri="/carRental_war/druid/login.html" OR uri="/carRental_war/druid/")