CVE-2025-10492 Overview
A Java deserialization vulnerability has been discovered in Jaspersoft Library that allows remote code execution. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library. This vulnerability affects multiple Jaspersoft products including JasperReports IO, JasperReports Library, JasperReports Server, JasperReports Studio, and JasperReports Web Studio.
Critical Impact
Remote attackers with low privileges can exploit insecure deserialization to execute arbitrary code on vulnerable systems, potentially leading to complete system compromise.
Affected Products
- Cloud JasperReports IO (Professional and At-Scale editions)
- Cloud JasperReports Library (Community and Professional editions)
- Cloud JasperReports Server
- Cloud JasperReports Studio (Community and Professional editions)
- Cloud JasperReports Web Studio
Discovery Timeline
- 2025-09-16 - CVE-2025-10492 published to NVD
- 2026-02-10 - Last updated in NVD database
Technical Details for CVE-2025-10492
Vulnerability Analysis
This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). Java deserialization vulnerabilities occur when an application deserializes data from untrusted sources without proper validation. In the context of Jaspersoft Library, the application fails to adequately sanitize externally supplied serialized Java objects before deserialization.
When a Java application deserializes an object, the ObjectInputStream.readObject() method reconstructs the object from its serialized form. If an attacker can control the serialized data, they can craft malicious objects that, when deserialized, trigger arbitrary code execution through gadget chains present in the application's classpath.
Root Cause
The root cause of CVE-2025-10492 lies in improper handling of externally supplied data during deserialization operations within the Jaspersoft Library. The application accepts serialized Java objects from untrusted sources and deserializes them without implementing proper safeguards such as:
- Input validation and filtering of serialized data
- Look-ahead object input stream filtering
- Allowlist-based class filtering during deserialization
This allows attackers to supply malicious serialized objects that can exploit known deserialization gadget chains to achieve remote code execution.
Attack Vector
The attack vector is network-based, requiring the attacker to have low-level privileges to submit crafted serialized objects to the vulnerable application. The exploitation does not require user interaction, making it particularly dangerous in automated or API-driven environments.
An attacker exploits this vulnerability by:
- Identifying a vulnerable endpoint that accepts serialized Java objects
- Crafting a malicious serialized object using known gadget chains (such as Commons Collections, Spring, or other libraries in the classpath)
- Submitting the crafted payload to the vulnerable Jaspersoft application
- Upon deserialization, the malicious object triggers the execution of arbitrary code with the privileges of the application
For technical details on the exploitation mechanism, refer to the Jaspersoft Security Advisory.
Detection Methods for CVE-2025-10492
Indicators of Compromise
- Unexpected Java process spawning child processes (e.g., cmd.exe, /bin/sh, powershell.exe)
- Unusual network connections from Jaspersoft application servers to external IP addresses
- Presence of serialized Java objects with known malicious gadget chain signatures in application logs or network traffic
- Abnormal heap memory consumption patterns indicating deserialization attacks
Detection Strategies
- Monitor for ObjectInputStream.readObject() calls with untrusted input sources in application logs
- Implement network intrusion detection rules to identify serialized Java object magic bytes (0xAC 0xED 0x00 0x05) in incoming traffic
- Deploy endpoint detection and response (EDR) solutions to detect post-exploitation behaviors such as reverse shells or reconnaissance commands
- Analyze Java application logs for deserialization exceptions or errors that may indicate exploitation attempts
Monitoring Recommendations
- Enable verbose logging for Jaspersoft applications to capture deserialization events
- Implement runtime application self-protection (RASP) solutions to monitor and block suspicious deserialization operations
- Set up alerts for Java processes executing unexpected system commands or establishing outbound network connections
- Regularly audit application dependencies for known vulnerable deserialization gadget libraries
How to Mitigate CVE-2025-10492
Immediate Actions Required
- Review the Jaspersoft Security Advisory for vendor-provided patches and updated versions
- Identify all instances of affected Jaspersoft products in your environment (JasperReports IO, Library, Server, Studio, and Web Studio)
- Apply available security patches from Jaspersoft immediately
- Restrict network access to Jaspersoft applications to trusted sources only
- Review and remove unnecessary gadget chain libraries from the application classpath
Patch Information
Jaspersoft has released security updates to address this vulnerability. Organizations should review the official Jaspersoft Security Advisory for specific patch versions and upgrade instructions for each affected product edition.
For Community Edition users, refer to the Jaspersoft Forum Discussion for additional guidance and workarounds.
Workarounds
- Implement Java serialization filters using ObjectInputFilter to restrict which classes can be deserialized
- Deploy a Web Application Firewall (WAF) to filter incoming requests containing serialized Java objects
- Isolate Jaspersoft applications in network segments with restricted access
- Consider replacing native Java serialization with safer alternatives such as JSON or XML with strict schema validation
# Example: Configure JVM serialization filter (Java 9+)
# Add to JVM startup arguments to restrict deserialization
java -Djdk.serialFilter="!*;maxdepth=5;maxrefs=100" -jar jasperreports-server.jar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
