CVE-2025-10092: Jinher OA XXE Vulnerability Explained

CVE-2025-10092 Overview

A critical XML External Entity (XXE) vulnerability has been discovered in Jinher OA, a popular office automation software. This vulnerability affects the XML Handler component within the Task Management module, specifically in the AddTask.aspx file. The flaw allows remote attackers to exploit improper XML parsing to access sensitive information, perform server-side request forgery, or potentially cause denial of service conditions.

Critical Impact

Remote attackers can exploit this XXE vulnerability without authentication to read arbitrary files, access internal network resources, or cause service disruption through malicious XML payloads.

Affected Products

• Jinher OA up to version 1.2
• Jinher OA Task Management Module (/c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx)
• XML Handler component in affected Jinher OA installations

Discovery Timeline

• 2025-09-08 - CVE-2025-10092 published to NVD
• 2025-10-09 - Last updated in NVD database

Technical Details for CVE-2025-10092

Vulnerability Analysis

This vulnerability stems from improper handling of XML input within the Jinher OA Task Management module. When the application processes XML data through the vulnerable endpoint at /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add, it fails to properly validate or sanitize external entity references. This allows attackers to inject malicious XML payloads containing external entity declarations that can reference local files, internal network resources, or external URLs.

The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). The exploit has been made public, increasing the risk of active exploitation against unpatched systems.

Root Cause

The root cause of this vulnerability lies in the XML parser configuration within the Jinher OA application. The parser is configured to process external entity references without proper restrictions or sanitization. When user-controlled XML data is submitted to the AddTask.aspx endpoint, the application's XML Handler component processes external entity declarations, allowing attackers to:

1. Define external entities pointing to local file system resources
2. Reference internal network services via SSRF-style attacks
3. Trigger recursive entity expansion for denial of service

The lack of input validation and secure XML parser configuration enables this attack vector.

Attack Vector

The attack is network-based and can be executed remotely without requiring authentication. An attacker crafts a malicious XML payload containing external entity references and submits it to the vulnerable endpoint. The XML Handler processes the payload, resolving the external entities and potentially exposing sensitive data or internal resources.

The attack flow involves submitting a crafted XML document to the AddTask.aspx endpoint with the Type=add parameter. The malicious XML contains DOCTYPE declarations with external entity definitions that reference system files (such as /etc/passwd on Linux or C:\Windows\win.ini on Windows) or internal network resources. When the server parses this XML, it attempts to resolve these entities, reading and potentially returning the contents in error messages or responses.

For detailed technical analysis, see the GitHub CVE Issue Discussion and VulDB Entry #323047.

Detection Methods for CVE-2025-10092

Indicators of Compromise

• Unusual HTTP POST requests to /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx containing XML payloads with DOCTYPE declarations
• Web server logs showing requests with <!ENTITY or SYSTEM keywords in request bodies
• Unexpected outbound connections from the Jinher OA server to internal network resources or external domains
• Error logs containing file path references or sensitive configuration data leakage

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XML payloads containing external entity declarations or DOCTYPE references
• Monitor HTTP traffic for POST requests to the vulnerable endpoint containing suspicious XML patterns such as <!DOCTYPE, <!ENTITY, or SYSTEM keywords
• Deploy network-based intrusion detection signatures to identify XXE attack patterns targeting Jinher OA installations
• Configure SentinelOne agents to monitor for suspicious file access patterns originating from the web application process

Monitoring Recommendations

• Enable detailed logging for the Jinher OA application, particularly for the Task Management module
• Set up alerts for any access attempts to sensitive system files from web application processes
• Monitor for unusual DNS queries or network connections originating from the Jinher OA server that may indicate SSRF via XXE
• Review web server access logs regularly for patterns indicating exploitation attempts against the AddTask.aspx endpoint

How to Mitigate CVE-2025-10092

Immediate Actions Required

• Restrict network access to the vulnerable endpoint /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx using firewall rules or access control lists
• Implement WAF rules to block XML payloads containing external entity declarations targeting Jinher OA
• Contact Jinher support for official patch availability and apply updates as soon as they become available
• Consider temporarily disabling the affected Task Management module if it is not business-critical

Patch Information

No vendor advisory or official patch information is currently available from Jinher. Organizations should monitor the vendor's official channels for security updates. In the interim, implementing the recommended workarounds and detection strategies is critical for protecting vulnerable installations.

For additional technical details and community discussion, refer to:

• GitHub CVE Issue Discussion
• VulDB Entry #323047

Workarounds

• Configure the XML parser to disable external entity processing by setting appropriate parser flags (e.g., disabling DTD processing entirely)
• Implement strict input validation on all XML data submitted to the application, rejecting any payloads containing DOCTYPE or ENTITY declarations
• Deploy a reverse proxy or WAF in front of the Jinher OA application to filter malicious XML content before it reaches the application
• Restrict the web application's file system and network access using principle of least privilege to limit the impact of successful exploitation

# Example WAF rule pattern for ModSecurity to block XXE attempts
# Add to your ModSecurity configuration
SecRule REQUEST_BODY "<!ENTITY" "id:100001,phase:2,deny,status:403,msg:'XXE Attack Detected'"
SecRule REQUEST_BODY "SYSTEM\s+[\"']" "id:100002,phase:2,deny,status:403,msg:'XXE External Entity Detected'"
SecRule REQUEST_BODY "<!DOCTYPE" "id:100003,phase:2,deny,status:403,msg:'DOCTYPE Declaration Blocked'"