CVE-2025-0399: Starsea99 Starsea-mall RCE Vulnerability

CVE-2025-0399 Overview

CVE-2025-0399 is an unrestricted file upload vulnerability in StarSea99 starsea-mall 1.0. The flaw resides in the UploadController function defined in src/main/java/com/siro/mall/controller/common/uploadController.java. Attackers can manipulate the file argument to upload arbitrary content without proper validation. The issue is exploitable remotely and has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is classified under [CWE-284] Improper Access Control. The vendor has not published a security advisory at the time of disclosure.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the UploadController endpoint, potentially staging follow-on payloads on the host file system.

Affected Products

StarSea99 starsea-mall 1.0.0
Component: starsea99:starsea-mall
File: src/main/java/com/siro/mall/controller/common/uploadController.java

Discovery Timeline

2025-01-12 - CVE-2025-0399 published to NVD
2025-10-10 - Last updated in NVD database

Technical Details for CVE-2025-0399

Vulnerability Analysis

The vulnerability exists in the UploadController handler of the starsea-mall e-commerce application. The handler accepts a file parameter from HTTP requests and writes the supplied content to the server without enforcing restrictions on file type, extension, content type, or destination path. Because the controller does not validate the uploaded artifact against an allowlist, an attacker holding valid credentials can submit executable web content or other unsafe formats. The disclosed proof-of-concept references the upstream project's public GitHub issue tracker, confirming reproducibility.

Root Cause

The root cause is missing input validation and access control around the file upload sink. The controller treats the file argument as trusted data and persists it directly. There is no enforcement of MIME type, extension allowlist, file magic-byte checks, or storage-location sandboxing. This pattern aligns with [CWE-284] Improper Access Control, where authorization on the upload action is insufficient to prevent abuse.

Attack Vector

The attack is network-reachable and requires the attacker to authenticate with high privileges before invoking the UploadController endpoint. No user interaction is required. After authentication, the attacker submits a crafted multipart request containing a malicious payload as the file parameter. Once stored, depending on the deployment configuration and where the file is written, the payload may be retrievable or executable by the web tier.

// No verified exploitation code is available.
// See the referenced GitHub issue and VulDB entries for technical details:
// - https://github.com/StarSea99/starsea-mall/issues/3
// - https://vuldb.com/?id.291274

Detection Methods for CVE-2025-0399

Indicators of Compromise

Unexpected files written under upload directories served by the starsea-mall application, particularly with executable or script extensions.
HTTP POST requests to the UploadController route from authenticated sessions outside normal administrative workflows.
Web server processes spawning shell or interpreter child processes shortly after upload activity.

Detection Strategies

Inspect application access logs for multipart/form-data requests targeting the upload endpoint and correlate with the authenticated user identity.
Monitor the upload storage directory for new files whose extensions or magic bytes do not match the expected media types.
Apply file integrity monitoring across application web roots to flag newly written .jsp, .war, .html, or other unexpected content.

Monitoring Recommendations

Forward web access logs and host file-creation events to a centralized analytics platform for cross-referencing user identity with upload activity.
Alert on any process execution chain where the Java application process writes a file that is subsequently read by the web server as an executable resource.
Track authentication anomalies for accounts with privileges to access the UploadController.

How to Mitigate CVE-2025-0399

Immediate Actions Required

Restrict network access to the starsea-mall administrative and upload endpoints using firewall rules or reverse-proxy ACLs.
Rotate credentials for any high-privilege accounts that can reach the UploadController endpoint.
Audit the upload storage directory for unauthorized files and remove suspicious artifacts.

Patch Information

No official vendor patch has been published at the time of writing. Refer to the upstream project's GitHub Issue Discussion and VulDB #291274 for status updates. Operators should track the repository for fixes and consider deploying compensating controls until a remediated release is available.

Workarounds

Implement an upstream web application firewall rule that blocks requests to the upload endpoint when the file parameter contains executable extensions such as .jsp, .jspx, .war, .php, or .sh.
Configure the web server to serve the upload directory as static, non-executable content and disable script handlers within that path.
Enforce server-side validation of file extension, MIME type, and content magic bytes before persistence, and rename uploaded files to non-executable identifiers.
Limit access to the UploadController to a tightly scoped role and remove the privilege from accounts that do not require uploads.

bash

# Example reverse-proxy rule (nginx) to block executable uploads to the controller
location /upload {
    if ($request_method = POST) {
        # Reject multipart bodies referencing executable extensions
        if ($request_body ~* "filename=\"[^\"]+\.(jsp|jspx|war|php|sh|py|exe)\"") {
            return 403;
        }
    }
}

# Ensure the upload storage path is not executed by the servlet container
location /uploads/ {
    types { }
    default_type application/octet-stream;
    add_header X-Content-Type-Options nosniff;
}