CVE-2025-11035: Jinher OA XXE Vulnerability

CVE-2025-11035 Overview

A vulnerability has been identified in Jinher OA 2.0 that allows for XML External Entity (XXE) injection attacks. The vulnerability exists in the ManageWord.aspx endpoint located at /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This XXE vulnerability enables attackers to manipulate XML input to reference external entities, potentially leading to data exfiltration, server-side request forgery, and information disclosure. The attack can be initiated remotely by authenticated users, and the exploit has been publicly disclosed.

Critical Impact

Remote attackers can exploit this XXE vulnerability to read arbitrary files on the server, perform server-side request forgery (SSRF), and potentially gain access to internal network resources through the Jinher OA application.

Affected Products

• Jinher OA version 2.0
• Jinher Jinher_OA (cpe:2.3:a:jinher:jinher_oa:2.0:*:*:*:*:*:*:*)

Discovery Timeline

• September 26, 2025 - CVE-2025-11035 published to NVD
• October 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11035

Vulnerability Analysis

This vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). The XXE vulnerability occurs when the Jinher OA application parses XML input without properly disabling external entity resolution. This allows attackers to inject malicious XML payloads that can reference external resources, local files, or internal network endpoints.

The vulnerable endpoint ManageWord.aspx processes XML data with the text=GetUrl and style=1 parameters. When the XML parser encounters an external entity declaration, it attempts to resolve the referenced resource, which can be leveraged by attackers for various malicious purposes including reading sensitive configuration files, accessing internal services, and potentially achieving remote code execution in certain configurations.

Root Cause

The root cause of this vulnerability is the improper configuration of the XML parser within the Jinher OA application. The parser does not disable Document Type Definition (DTD) processing or external entity resolution, allowing attackers to define and resolve external entities within XML payloads. This is a common misconfiguration in applications that process XML input without implementing secure parsing practices.

Attack Vector

The attack can be executed remotely over the network and requires low-privilege authentication. An attacker with valid credentials to the Jinher OA system can craft a malicious XML payload containing external entity declarations and submit it to the vulnerable ManageWord.aspx endpoint. The XML parser will process the payload and attempt to resolve any external entities defined, potentially returning sensitive data in the server's response or triggering outbound connections to attacker-controlled infrastructure.

XXE attacks typically leverage the XML parser's ability to include external resources through entity declarations. By defining an entity that references a local file path (such as /etc/passwd on Linux or C:\Windows\win.ini on Windows), attackers can exfiltrate file contents. Additionally, attackers can use XXE for blind SSRF attacks by referencing internal network resources or external attacker-controlled servers to confirm vulnerability exploitation.

Detection Methods for CVE-2025-11035

Indicators of Compromise

• Unusual requests to /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx containing XML payloads with DOCTYPE declarations
• Web server logs showing requests with external entity references (e.g., SYSTEM, PUBLIC, or file:// protocols)
• Outbound connections from the Jinher OA server to unexpected external hosts or internal IP addresses
• Error messages or responses containing contents of local system files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XML payloads containing <!DOCTYPE declarations with external entity references
• Monitor HTTP request bodies for common XXE patterns including <!ENTITY, SYSTEM, PUBLIC, and protocol handlers like file://, http://, or gopher://
• Configure network intrusion detection systems (IDS) to alert on suspicious outbound connections originating from the Jinher OA application server
• Deploy endpoint detection and response (EDR) solutions to monitor for file access patterns indicative of XXE exploitation

Monitoring Recommendations

• Enable detailed logging on the Jinher OA web server to capture full request bodies for forensic analysis
• Set up alerts for requests to the ManageWord.aspx endpoint with abnormal parameter values or XML content
• Monitor for unusual file read operations or network connections initiated by the web application process
• Implement anomaly detection for authentication patterns that may indicate credential compromise preceding XXE exploitation

How to Mitigate CVE-2025-11035

Immediate Actions Required

• Restrict access to the vulnerable ManageWord.aspx endpoint through network segmentation or access control lists
• Implement a web application firewall rule to block requests containing XML external entity declarations
• Review and audit user accounts with access to the affected functionality and remove unnecessary permissions
• Consider temporarily disabling the vulnerable feature if it is not critical to business operations

Patch Information

No official vendor patch information is currently available for this vulnerability. Organizations should monitor Jinher for security advisories and updates. Technical details are available through the GitHub CVE Issue and VulDB Entry #325982.

Workarounds

• Configure the XML parser to disable DTD processing and external entity resolution at the application or server level
• Implement input validation to sanitize or reject XML payloads containing DOCTYPE declarations before they reach the parser
• Deploy network-level controls to limit outbound connections from the Jinher OA server to prevent data exfiltration via out-of-band XXE
• Use a proxy or API gateway to inspect and filter XML content before it reaches the vulnerable application

For ASP.NET applications, the following configuration changes can help mitigate XXE vulnerabilities at the framework level:

<!-- Web.config security hardening for XML processing -->
<configuration>
  <system.xml.serialization>
    <xmlSerializer useLegacySerializerGeneration="false"/>
  </system.xml.serialization>
</configuration>