CVE-2025-51743: Critical Fastjson Deserialization Vulnerability Discovered in JSH_ERP

Overview

CVE-2025-51743 identifies a critical security vulnerability affecting jishenghua JSH_ERP version 2.3.1. This vulnerability stems from the improper handling of deserialization processes within the /materialCategory/addMaterialCategory endpoint, making the application susceptible to Fastjson deserialization attacks. Successful exploitation of this vulnerability could lead to remote code execution, data breaches, or other severe security compromises.

Technical Details

The /materialCategory/addMaterialCategory endpoint in JSH_ERP 2.3.1 is vulnerable because it doesn’t adequately sanitize or validate user-supplied input before deserializing it using Fastjson. An attacker can craft a malicious JSON payload containing instructions to execute arbitrary code on the server. This payload is then sent to the vulnerable endpoint. The Fastjson library processes the payload, creating Java objects based on the attacker’s instructions, which ultimately results in code execution under the security context of the JSH_ERP application.

CVSS Analysis

Currently, the CVSS score for CVE-2025-51743 is not yet available (N/A). However, given the potential for remote code execution via Fastjson deserialization, it is highly likely that this vulnerability will be assigned a critical CVSS score (9.0-10.0) once assessed.

Possible Impact

The potential impact of exploiting CVE-2025-51743 is significant. A successful attacker could:

• Execute arbitrary code on the server hosting JSH_ERP.
• Gain unauthorized access to sensitive data, including financial records, customer information, and internal documents.
• Compromise the entire JSH_ERP system, leading to business disruption and reputational damage.
• Use the compromised server as a launchpad for further attacks on other systems within the network.

Mitigation or Patch Steps

To mitigate the risk posed by CVE-2025-51743, the following steps are recommended:

1. Upgrade JSH_ERP: The most effective solution is to upgrade to a patched version of JSH_ERP that addresses the Fastjson deserialization vulnerability. Check the JSH_ERP Gitee repository for updates and patches.
2. Input Validation: Implement robust input validation and sanitization measures on the /materialCategory/addMaterialCategory endpoint and other areas of the application that handle user-supplied JSON data.
3. Disable Autotype: If possible, disable Fastjson’s autotype feature, which can reduce the attack surface. This may require code changes within the application.
4. Web Application Firewall (WAF): Deploy a Web Application Firewall (WAF) to filter malicious JSON payloads before they reach the JSH_ERP application. Configure the WAF with rules to detect and block known Fastjson attack patterns.
5. Monitor for Suspicious Activity: Implement security monitoring to detect unusual network traffic or application behavior that might indicate an attempted exploitation.

References

Hackpax Blog Post on JSH_ERP Vulnerability
Gist Detailing the JSH_ERP Exploit
Jishenghua Gitee Profile
JSH_ERP Gitee Repository