CVE-2025-10492: Cloud Jasperreports Io RCE Vulnerability

CVE-2025-10492 Overview

A Java deserialization vulnerability has been discovered in Jaspersoft Library that allows remote code execution. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library. This vulnerability affects multiple Jaspersoft products including JasperReports IO, JasperReports Library, JasperReports Server, JasperReports Studio, and JasperReports Web Studio.

Critical Impact
Remote attackers with low privileges can exploit insecure deserialization to execute arbitrary code on vulnerable systems, potentially leading to complete system compromise.

Affected Products

Cloud JasperReports IO (Professional and At-Scale editions)
Cloud JasperReports Library (Community and Professional editions)
Cloud JasperReports Server
Cloud JasperReports Studio (Community and Professional editions)
Cloud JasperReports Web Studio

Discovery Timeline

2025-09-16 - CVE-2025-10492 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-10492

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). Java deserialization vulnerabilities occur when an application deserializes data from untrusted sources without proper validation. In the context of Jaspersoft Library, the application fails to adequately sanitize externally supplied serialized Java objects before deserialization.

When a Java application deserializes an object, the ObjectInputStream.readObject() method reconstructs the object from its serialized form. If an attacker can control the serialized data, they can craft malicious objects that, when deserialized, trigger arbitrary code execution through gadget chains present in the application's classpath.

Root Cause

The root cause of CVE-2025-10492 lies in improper handling of externally supplied data during deserialization operations within the Jaspersoft Library. The application accepts serialized Java objects from untrusted sources and deserializes them without implementing proper safeguards such as:

Input validation and filtering of serialized data
Look-ahead object input stream filtering
Allowlist-based class filtering during deserialization

This allows attackers to supply malicious serialized objects that can exploit known deserialization gadget chains to achieve remote code execution.

Attack Vector

The attack vector is network-based, requiring the attacker to have low-level privileges to submit crafted serialized objects to the vulnerable application. The exploitation does not require user interaction, making it particularly dangerous in automated or API-driven environments.

An attacker exploits this vulnerability by:

Identifying a vulnerable endpoint that accepts serialized Java objects
Crafting a malicious serialized object using known gadget chains (such as Commons Collections, Spring, or other libraries in the classpath)
Submitting the crafted payload to the vulnerable Jaspersoft application
Upon deserialization, the malicious object triggers the execution of arbitrary code with the privileges of the application

For technical details on the exploitation mechanism, refer to the Jaspersoft Security Advisory.

Detection Methods for CVE-2025-10492

Indicators of Compromise

Unexpected Java process spawning child processes (e.g., cmd.exe, /bin/sh, powershell.exe)
Unusual network connections from Jaspersoft application servers to external IP addresses
Presence of serialized Java objects with known malicious gadget chain signatures in application logs or network traffic
Abnormal heap memory consumption patterns indicating deserialization attacks

Detection Strategies

Monitor for ObjectInputStream.readObject() calls with untrusted input sources in application logs
Implement network intrusion detection rules to identify serialized Java object magic bytes (0xAC 0xED 0x00 0x05) in incoming traffic
Deploy endpoint detection and response (EDR) solutions to detect post-exploitation behaviors such as reverse shells or reconnaissance commands
Analyze Java application logs for deserialization exceptions or errors that may indicate exploitation attempts

Monitoring Recommendations

Enable verbose logging for Jaspersoft applications to capture deserialization events
Implement runtime application self-protection (RASP) solutions to monitor and block suspicious deserialization operations
Set up alerts for Java processes executing unexpected system commands or establishing outbound network connections
Regularly audit application dependencies for known vulnerable deserialization gadget libraries

How to Mitigate CVE-2025-10492

Immediate Actions Required

Review the Jaspersoft Security Advisory for vendor-provided patches and updated versions
Identify all instances of affected Jaspersoft products in your environment (JasperReports IO, Library, Server, Studio, and Web Studio)
Apply available security patches from Jaspersoft immediately
Restrict network access to Jaspersoft applications to trusted sources only
Review and remove unnecessary gadget chain libraries from the application classpath

Patch Information

Jaspersoft has released security updates to address this vulnerability. Organizations should review the official Jaspersoft Security Advisory for specific patch versions and upgrade instructions for each affected product edition.

For Community Edition users, refer to the Jaspersoft Forum Discussion for additional guidance and workarounds.

Workarounds

Implement Java serialization filters using ObjectInputFilter to restrict which classes can be deserialized
Deploy a Web Application Firewall (WAF) to filter incoming requests containing serialized Java objects
Isolate Jaspersoft applications in network segments with restricted access
Consider replacing native Java serialization with safer alternatives such as JSON or XML with strict schema validation

bash

# Example: Configure JVM serialization filter (Java 9+)
# Add to JVM startup arguments to restrict deserialization
java -Djdk.serialFilter="!*;maxdepth=5;maxrefs=100" -jar jasperreports-server.jar