CVE-2025-0702: Joeybling Bootplus RCE Vulnerability

CVE-2025-0702 Overview

CVE-2025-0702 is an unrestricted file upload vulnerability in JoeyBling bootplus, a Spring Boot-based administrative framework. The flaw resides in src/main/java/io/github/controller/SysFileController.java and is triggered through manipulation of the portraitFile argument. Attackers can exploit the issue remotely without user interaction, though authenticated access at low privilege is required. Because bootplus uses continuous delivery with rolling releases, no discrete affected or fixed version numbers are published. The weakness is categorized under [CWE-284] Improper Access Control. Public disclosure has occurred through GitHub and VulDB tracking.

Critical Impact
Authenticated attackers can upload arbitrary files via the portraitFile parameter, enabling potential web shell deployment and downstream code execution on affected bootplus instances.

Affected Products

JoeyBling bootplus up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d
SysFileController.java file upload handler
Rolling-release deployments of bootplus without compensating controls

Discovery Timeline

2025-01-24 - CVE-2025-0702 published to NVD
2025-10-10 - Last updated in NVD database

Technical Details for CVE-2025-0702

Vulnerability Analysis

The vulnerability exists in the file upload handler defined in SysFileController.java. The controller accepts a portraitFile parameter intended for user portrait or avatar uploads. The handler does not enforce restrictions on file type, extension, content, or MIME headers before persisting the uploaded artifact. Attackers can submit executable server-side content, such as JSP or other scripts interpretable by the underlying Spring Boot runtime, in place of an expected image.

The attack can be initiated over the network with low-complexity requests. Authenticated low-privilege users can submit the malicious upload, and once stored within a web-accessible directory, the file may be retrieved or executed depending on deployment configuration. EPSS modeling places exploit probability at 0.618%.

Root Cause

The root cause is improper access control on the file upload endpoint [CWE-284]. The controller lacks server-side validation of file metadata and contents. There is no allowlist of permitted extensions, no magic-byte verification, and no enforcement that uploaded files be stored outside of executable web paths.

Attack Vector

An authenticated attacker sends a crafted multipart HTTP POST request to the bootplus upload endpoint, supplying a malicious payload as the portraitFile field. The server stores the file without validation. The attacker then requests the stored resource through the web tier, triggering server-side execution or distributing the content to other users. Public disclosure on the project's GitHub issue tracker provides reproduction details. See the GitHub Issue Discussion for the original report.

No verified exploit code is published in the enriched references.
Refer to the GitHub issue and VulDB entry for additional technical context.

Detection Methods for CVE-2025-0702

Indicators of Compromise

Multipart POST requests to bootplus endpoints containing portraitFile with non-image extensions such as .jsp, .jspx, .war, or .sh
New files in upload directories whose magic bytes do not match the declared MIME type
Outbound connections originating from the bootplus JVM process following an upload event
HTTP requests to uploaded artifact paths returning non-static response headers

Detection Strategies

Inspect application logs for SysFileController upload entries lacking corresponding image processing operations
Apply web application firewall rules to flag multipart uploads where filename extensions diverge from Content-Type
Hash and baseline files in upload directories; alert on creation of script-interpretable extensions

Monitoring Recommendations

Monitor Spring Boot access logs for repeated POSTs to the portrait upload route from a single principal
Track child processes spawned by the bootplus JVM and alert on shell or interpreter execution
Correlate upload events with subsequent GET requests to the same stored filename within short time windows

How to Mitigate CVE-2025-0702

Immediate Actions Required

Restrict access to the bootplus administrative interface to trusted networks until a patched commit is deployed
Disable or gate the portraitFile upload route behind reverse-proxy ACLs if unused
Audit existing upload directories for unauthorized files and remove suspicious artifacts
Rotate credentials for any low-privilege accounts that could submit uploads

Patch Information

JoeyBling bootplus follows a continuous-delivery model with rolling releases. The NVD entry states no discrete affected or fixed version identifiers are available. Operators should pull the latest upstream commit and verify that SysFileController.java performs server-side extension allowlisting, MIME validation, and storage outside of executable paths. Track the upstream GitHub Issue and the VulDB entry #293230 for remediation updates.

Workarounds

Place a reverse proxy in front of bootplus that enforces an allowlist of image MIME types on the upload route
Store uploaded files in a directory served as static content only, with script execution disabled
Rename uploaded files to server-generated identifiers and strip user-supplied extensions
Apply a WAF rule to drop multipart requests where portraitFile filename ends in executable extensions

bash

# Example NGINX configuration to neutralize script execution in upload paths
location /upload/ {
    types { }
    default_type application/octet-stream;
    add_header X-Content-Type-Options nosniff;
    location ~* \.(jsp|jspx|war|sh|php)$ {
        deny all;
    }
}