CVE-2025-12305: Quequnlong Shiyi-blog RCE Vulnerability

CVE-2025-12305 Overview

A critical insecure deserialization vulnerability has been identified in quequnlong shiyi-blog versions up to 1.2.1. This vulnerability affects the Job Handler component within the SysJobController.java file, allowing attackers to exploit deserialization weaknesses remotely. The manipulation of data processed by this controller can lead to arbitrary code execution through unsafe object deserialization.

Critical Impact

Remote attackers can exploit this deserialization vulnerability to execute arbitrary code on affected shiyi-blog installations, potentially leading to complete system compromise.

Affected Products

• quequnlong shiyi-blog versions up to 1.2.1
• Systems running the vulnerable SysJobController.java Job Handler component

Discovery Timeline

• October 27, 2025 - CVE-2025-12305 published to NVD
• November 05, 2025 - Last updated in NVD database

Technical Details for CVE-2025-12305

Vulnerability Analysis

This vulnerability resides in the Job Handler functionality of the shiyi-blog application, specifically within the src/main/java/com/mojian/controller/SysJobController.java file. The deserialization flaw (CWE-502) combined with improper input validation (CWE-20) creates a dangerous attack surface that can be exploited remotely over the network.

The vulnerability allows an attacker to submit maliciously crafted serialized Java objects to the Job Handler endpoint. When these objects are deserialized by the application without proper validation, the attacker can achieve remote code execution. This type of vulnerability is particularly dangerous in Java applications as it can leverage existing gadget chains present in the application's classpath to execute arbitrary commands.

The attack requires low privileges and no user interaction, making it relatively straightforward for authenticated attackers to exploit. A public exploit has been disclosed, increasing the risk of widespread exploitation.

Root Cause

The root cause of this vulnerability is the unsafe deserialization of untrusted data in the Job Handler component. The SysJobController.java file processes serialized objects without implementing proper validation or filtering of the incoming data. This allows malicious serialized payloads to be processed, triggering code execution when dangerous classes are instantiated during deserialization.

The combination of CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation) indicates that the application fails to both validate input before deserialization and properly restrict which classes can be deserialized.

Attack Vector

The attack can be executed remotely over the network by authenticated users with low-level privileges. The attacker crafts a malicious serialized Java object containing a payload that, when deserialized, executes arbitrary code on the target system.

The exploitation process involves:

1. Identifying the vulnerable Job Handler endpoint in the shiyi-blog application
2. Crafting a malicious serialized Java object using tools like ysoserial
3. Sending the payload to the vulnerable endpoint
4. The server deserializes the malicious object, triggering code execution

For technical details on the exploitation mechanism, refer to the GitHub RCE Analysis documentation.

Detection Methods for CVE-2025-12305

Indicators of Compromise

• Unusual network traffic to the SysJobController endpoint with large or suspicious payloads
• Unexpected process spawning from the Java application server process
• Anomalous file system activity or new files created by the web application user
• Log entries showing deserialization errors or unusual class loading activity

Detection Strategies

• Monitor HTTP requests to Job Handler endpoints for suspicious serialized object patterns
• Implement application-level logging for all deserialization operations in the Job Handler
• Deploy Java Runtime Application Self-Protection (RASP) solutions to detect deserialization attacks
• Use SentinelOne Singularity to detect and block malicious payload execution attempts

Monitoring Recommendations

• Enable detailed logging for the SysJobController.java component
• Set up alerts for unexpected outbound connections from the application server
• Monitor for known deserialization gadget chain signatures in network traffic
• Implement file integrity monitoring on critical system directories

How to Mitigate CVE-2025-12305

Immediate Actions Required

• Audit current shiyi-blog installations to identify vulnerable versions (up to 1.2.1)
• Restrict network access to the Job Handler endpoint to trusted sources only
• Implement Web Application Firewall (WAF) rules to filter suspicious serialized payloads
• Consider temporarily disabling the Job Handler functionality until a patch is available

Patch Information

As of the last update on November 05, 2025, users should check the quequnlong shiyi-blog repository for security updates. Monitor the VulDB entry and the official project repository for patch announcements. Upgrade to versions newer than 1.2.1 when available.

Workarounds

• Implement input validation and whitelisting of allowed classes for deserialization
• Use serialization filters (JEP 290) to restrict which classes can be deserialized
• Deploy network segmentation to limit exposure of the vulnerable endpoint
• Apply the principle of least privilege to the application's runtime user account

To implement Java serialization filtering as a workaround, configure the JVM with ObjectInputFilter:

# Add JVM argument to restrict deserialization
java -Djdk.serialFilter="!*" -jar shiyi-blog.jar

# Or configure a more granular filter allowing only safe classes
java -Djdk.serialFilter="com.mojian.model.*;!*" -jar shiyi-blog.jar