CVE-2025-13249: Jiusi OA Unrestricted Upload RCE Vulnerability

CVE-2025-13249 Overview

CVE-2025-13249 is an unrestricted file upload vulnerability in Jiusi OA versions up to 20251102. The flaw resides in the OfficeServer interface, specifically the /OfficeServer?isAjaxDownloadTemplate=false endpoint. Manipulation of the FileData parameter allows an authenticated remote attacker to upload arbitrary files without validation. The weakness is classified as [CWE-284] Improper Access Control. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact

Authenticated attackers can upload arbitrary files remotely through the OfficeServer interface, potentially staging web shells or malicious content on affected Jiusi OA deployments.

Affected Products

• Jiusi OA versions up to and including 20251102
• OfficeServer Interface component
• Deployments exposing the /OfficeServer endpoint to untrusted networks

Discovery Timeline

• 2025-11-16 - CVE-2025-13249 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13249

Vulnerability Analysis

The vulnerability affects the OfficeServer interface of Jiusi OA, an office automation platform. The endpoint /OfficeServer?isAjaxDownloadTemplate=false accepts a FileData parameter without enforcing file type, extension, or content validation. This design allows a low-privileged remote user to write arbitrary content to the server file system.

Exploitation requires network access and low-level privileges but no user interaction. Once a malicious file is placed within a web-accessible directory, an attacker may achieve secondary impact such as web shell deployment or content tampering. The impact affects confidentiality, integrity, and availability at a limited scope. Public disclosure has been observed, though no entries appear on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control combined with missing upload validation [CWE-284]. The OfficeServer handler does not enforce allow-listing of file types or restrict destination paths. Any authenticated caller can direct the server to persist attacker-supplied binary data through the FileData argument.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to /OfficeServer?isAjaxDownloadTemplate=false containing an arbitrary payload in the FileData parameter. Technical details are available in the GitHub project documentation and the corresponding VulDB entry #332583.

No verified proof-of-concept code is included in this article. Refer to the linked public write-ups for request structure and reproduction steps.

Detection Methods for CVE-2025-13249

Indicators of Compromise

• HTTP requests targeting /OfficeServer?isAjaxDownloadTemplate=false containing multipart or binary payloads in the FileData parameter.
• New or modified files with executable server-side extensions (.jsp, .aspx, .php) appearing in Jiusi OA upload or template directories.
• Outbound network connections from the Jiusi OA process to unfamiliar hosts following upload activity.

Detection Strategies

• Monitor web server access logs for POST or GET requests to the OfficeServer endpoint with anomalously large bodies or unusual content types.
• Baseline the file inventory of Jiusi OA web directories and alert on newly created server-executable files.
• Correlate authentication events with upload activity to identify low-privileged accounts abusing the endpoint.

Monitoring Recommendations

• Enable full HTTP request logging on the Jiusi OA front-end and forward logs to a centralized analytics platform for retention.
• Instrument the application server to record file writes performed by the OfficeServer handler with source IP and user identity.
• Alert on process execution originating from web-accessible directories, a common indicator of successful web shell deployment.

How to Mitigate CVE-2025-13249

Immediate Actions Required

• Restrict network access to the Jiusi OA /OfficeServer endpoint through firewall rules or reverse proxy allow-lists.
• Audit Jiusi OA upload and template directories for unauthorized files created since exposure of the endpoint.
• Rotate credentials for all accounts with access to the OfficeServer interface, as low-privileged authentication is sufficient for exploitation.

Patch Information

As of the latest NVD update on 2026-06-17, no vendor patch reference is published in the CVE record. Contact the Jiusi OA vendor for an updated build addressing the OfficeServer upload validation. Track the VulDB advisory #332583 for remediation updates.

Workarounds

• Deploy a web application firewall rule blocking requests to /OfficeServer?isAjaxDownloadTemplate=false with FileData payloads containing server-executable content.
• Configure the web server to deny execution of scripts within upload directories using handler mappings or .htaccess equivalents.
• Remove or disable the OfficeServer interface if the functionality is not required in the deployment.

# Example nginx configuration to block the vulnerable endpoint
location ~* ^/OfficeServer {
    if ($arg_isAjaxDownloadTemplate = "false") {
        return 403;
    }
}

# Deny script execution in upload directories
location ~* ^/uploads/.*\.(jsp|aspx|php)$ {
    return 403;
}