CVE-2025-1225: R1bbit Yimioa XXE Vulnerability

CVE-2025-1225 Overview

CVE-2025-1225 is an XML External Entity (XXE) vulnerability in r1bbit yimioa versions up to 2024.07.03. The flaw exists in the extract function of the c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java file, which is part of the WXCallBack Interface. Attackers with low-privilege network access can submit crafted XML payloads to trigger external entity resolution. The vulnerability is classified under [CWE-610] Externally Controlled Reference to a Resource in Another Sphere and [CWE-611] Improper Restriction of XML External Entity Reference. The exploit has been publicly disclosed, and upgrading to version 2024.07.04 remediates the issue.

Critical Impact
Remote attackers can abuse the XML parser in the WXCallBack Interface to read local files, perform server-side request forgery, or leak sensitive configuration data from the yimioa application server.

Affected Products

r1bbit yimioa versions up to and including 2024.07.03
Component: WXCallBack Interface
File: c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java

Discovery Timeline

2025-02-12 - CVE-2025-1225 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1225

Vulnerability Analysis

The vulnerability resides in the extract function of XMLParse.java, which processes XML data received through the WeChat callback endpoint. The parser accepts XML input without disabling external entity resolution. An attacker can submit a crafted XML document containing a DOCTYPE declaration referencing an external entity. When the parser resolves the entity, it fetches the referenced resource and embeds it in the parsed document.

This behavior allows arbitrary file disclosure, internal network probing via server-side request forgery, and potential denial of service through entity expansion attacks. The WXCallBack Interface is exposed over the network and requires only low-level privileges to reach, which broadens the attack surface for internet-facing yimioa deployments.

Root Cause

The root cause is an insecurely configured XML parser inside the extract method. Java XML parsers such as DocumentBuilderFactory, SAXParserFactory, and XMLInputFactory resolve external entities by default. Because the yimioa developers did not disable features like external-general-entities, external-parameter-entities, or set a restrictive entity resolver, any XML payload sent to the WXCallBack endpoint is fully processed, including external DTD and entity references.

Attack Vector

The attack is remote and requires network access to the WeChat callback endpoint served by yimioa. An authenticated user with minimal privileges submits an HTTP request containing an XML body that defines an external entity pointing to a local file (for example file:///etc/passwd) or an internal HTTP resource. When XMLParse.extract processes the payload, the parser dereferences the entity and returns its contents in the parsed structure or in error responses. See the Gitee Issue Report IBI81R for the disclosed technical details.

No verified proof-of-concept code is provided in the enriched dataset. Refer to the VulDB CTI Report #295211 for additional context on exploitation.

Detection Methods for CVE-2025-1225

Indicators of Compromise

Inbound HTTP requests to the WXCallBack endpoint containing XML bodies with <!DOCTYPE declarations or <!ENTITY definitions.
Outbound network connections from the yimioa Java process to unexpected internal hosts, file:// handlers, or attacker-controlled DNS names.
Application logs showing XML parsing errors referencing external URIs, missing DTDs, or entity resolution failures.

Detection Strategies

Inspect HTTP request bodies destined for the WeChat callback URI for XML content that includes SYSTEM, PUBLIC, or % parameter entities.
Correlate WXCallBack request events with outbound DNS lookups or HTTP fetches performed by the yimioa JVM within a short time window.
Monitor filesystem read events on sensitive paths such as /etc/passwd, application configuration files, and credential stores initiated by the yimioa service account.

Monitoring Recommendations

Enable verbose logging on the yimioa web tier and forward logs to a centralized platform for pattern matching on XML entity indicators.
Baseline outbound network traffic from the yimioa host and alert on deviations, particularly connections to non-corporate destinations.
Track the yimioa release version deployed in production and alert when instances remain below 2024.07.04.

How to Mitigate CVE-2025-1225

Immediate Actions Required

Upgrade all yimioa deployments to version 2024.07.04 or later, which remediates the XXE flaw in XMLParse.java.
Restrict network reachability of the WXCallBack Interface to trusted WeChat callback source ranges using firewall or reverse-proxy rules.
Audit application and web server logs for prior XML payloads containing external entity declarations targeting the callback endpoint.

Patch Information

The vendor released the fix in yimioa 2024.07.04. The patch is referenced in the Gitee Issue Report IBI81R. Additional vulnerability metadata is available through the VulDB #295211 entry.

Workarounds

If immediate patching is not feasible, deploy a web application firewall rule that blocks requests to the WXCallBack endpoint containing <!DOCTYPE, <!ENTITY, or SYSTEM tokens in the body.
Configure the reverse proxy to reject XML content types on the callback endpoint that originate from unexpected source IP ranges.
Harden the JVM process by removing outbound network egress rights from the yimioa host to limit SSRF impact until the upgrade is applied.

bash

# Example WAF rule (ModSecurity) to block XXE payloads on the WXCallBack endpoint
SecRule REQUEST_URI "@contains /weixin/callback" \
  "chain,phase:2,deny,status:403,id:1002025,\
   msg:'Potential XXE payload targeting yimioa WXCallBack (CVE-2025-1225)'"
  SecRule REQUEST_BODY "@rx (?i)(<!DOCTYPE|<!ENTITY|SYSTEM\s+\"|PUBLIC\s+\")" "t:none"