CVE-2025-34039

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations.

CVSS

No CVSS.

References

Link	Resource
https://vulncheck.com/advisories/yonyou-ufida-nc-beanshell-code-injection
https://www.cnblogs.com/pursue-security/p/17685141.html
https://www.cnvd.org.cn/flaw/show/CNVD-2021-30167

Configurations

No configuration.

History

26 Jun 2025, 18:58

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de inyección de código en Yonyou UFIDA NC v6.5 y versiones anteriores debido a la exposición del servlet de pruebas BeanShell (bsh.servlet.BshServlet) sin los controles de acceso adecuados. El servlet permite a atacantes remotos no autenticados ejecutar código Java arbitrario mediante el parámetro bsh.script. Esto puede explotarse para ejecutar comandos del sistema y, en última instancia, obtener el control total del servidor objetivo. El problema se origina en un componente JAR de terceros incluido en la aplicación, y el servlet es accesible sin autenticación en instalaciones vulnerables.

24 Jun 2025, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-24 02:15

Updated : 2025-06-26 18:58

NVD link : CVE-2025-34039

Mitre link : CVE-2025-34039

CVE.ORG link : CVE-2025-34039

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-34039", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-24T02:15:22.540", "references": [{"url": "https://vulncheck.com/advisories/yonyou-ufida-nc-beanshell-code-injection", "source": "disclosure@vulncheck.com"}, {"url": "https://www.cnblogs.com/pursue-security/p/17685141.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-30167", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en Yonyou UFIDA NC v6.5 y versiones anteriores debido a la exposici\u00f3n del servlet de pruebas BeanShell (bsh.servlet.BshServlet) sin los controles de acceso adecuados. El servlet permite a atacantes remotos no autenticados ejecutar c\u00f3digo Java arbitrario mediante el par\u00e1metro bsh.script. Esto puede explotarse para ejecutar comandos del sistema y, en \u00faltima instancia, obtener el control total del servidor objetivo. El problema se origina en un componente JAR de terceros incluido en la aplicaci\u00f3n, y el servlet es accesible sin autenticaci\u00f3n en instalaciones vulnerables."}], "lastModified": "2025-06-26T18:58:14.280", "sourceIdentifier": "disclosure@vulncheck.com"}