CVE-2025-0402: 1902756969 Reggie RCE Vulnerability

CVE-2025-0402 Overview

CVE-2025-0402 is an unrestricted file upload vulnerability affecting the upload function in src/main/java/com/itheima/reggie/controller/CommonController.java within 1902756969 Reggie version 1.0. The file parameter accepts attacker-controlled input without proper validation, allowing remote upload of arbitrary file types. The flaw maps to [CWE-284: Improper Access Control] and is exploitable over the network with low privileges. Public disclosure of the exploit increases the risk of opportunistic attacks against exposed instances.

Critical Impact

Authenticated remote attackers can upload arbitrary files to the application, potentially enabling webshell deployment and follow-on code execution depending on server configuration.

Affected Products

• 1902756969 Reggie 1.0
• Component: CommonController.java (upload function)
• Parameter: file

Discovery Timeline

• 2025-01-13 - CVE-2025-0402 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0402

Vulnerability Analysis

The vulnerability resides in the upload function of CommonController.java, a Spring-based controller in the Reggie application. The endpoint accepts a multipart file parameter and writes it to the filesystem without validating the file type, extension, content, or destination path. An attacker can submit a crafted HTTP request to upload executable scripts, configuration files, or other unauthorized content.

Because the upload occurs over the network and requires only low privileges, exploitation is trivial against accessible instances. The exploit details have been disclosed publicly through the project's GitHub issue tracker and VulDB, lowering the barrier for attackers. The vulnerability has an EPSS score of 0.363% (percentile 28.042).

Root Cause

The root cause is the absence of allowlist-based validation on uploaded files. The upload handler trusts the client-supplied filename and content type, omitting checks for extension, MIME type, magic bytes, and storage location. This pattern reflects [CWE-284] improper access control over an exposed file-write operation.

Attack Vector

The attacker sends a multipart/form-data POST request to the upload endpoint with a malicious file as the file parameter. No user interaction is required. If the application stores uploads within a web-accessible directory and serves them with execution privileges, the attacker can request the uploaded file to achieve script execution. See the GitHub Issue Discussion for technical details on the affected code path.

Detection Methods for CVE-2025-0402

Indicators of Compromise

• Unexpected files appearing in upload directories with executable extensions such as .jsp, .jspx, .war, or .sh.
• HTTP POST requests to the Reggie upload endpoint with non-image MIME types or oversized payloads.
• New outbound network connections originating from the Java application process after upload activity.

Detection Strategies

• Inspect web server and application logs for multipart/form-data requests targeting the upload controller with anomalous filenames.
• Deploy file integrity monitoring on upload directories to flag creation of non-whitelisted file types.
• Correlate process telemetry from the JVM with subsequent shell or interpreter spawning to identify webshell execution.

Monitoring Recommendations

• Enable verbose request logging on the upload endpoint, capturing source IP, filename, content type, and size.
• Alert on JVM child processes such as bash, sh, cmd.exe, or powershell.exe, which typically indicate post-exploitation activity.
• Forward web and host telemetry to a centralized analytics platform to identify cross-stage attack patterns.

How to Mitigate CVE-2025-0402

Immediate Actions Required

• Restrict network access to the Reggie application using firewall rules or reverse proxy controls until a fix is applied.
• Disable or remove the upload endpoint if it is not required for business operations.
• Audit existing upload directories for unauthorized files and remove any unexpected executable content.

Patch Information

No official vendor patch has been published at the time of writing. The project is hosted at 1902756969/reggie on GitHub, and downstream users should track the upstream issue tracker for fix availability. Organizations using forks of Reggie should apply server-side validation directly to the upload function.

Workarounds

• Implement an allowlist of permitted file extensions and MIME types in the upload controller, rejecting all others.
• Validate uploaded content using magic-byte inspection rather than relying on client-supplied metadata.
• Store uploaded files outside the web root and serve them through a controller that disables script execution.
• Apply size limits and rate limiting to the upload endpoint to reduce abuse potential.

# Example reverse proxy restriction (nginx) to limit upload size and block executable extensions
client_max_body_size 2m;
location /common/upload {
    if ($request_method !~ ^(POST)$) { return 405; }
    if ($http_content_type !~* "image/(jpeg|png|gif)") { return 415; }
}
location ~* \.(jsp|jspx|war|sh|php)$ {
    deny all;
}