CVE-2025-13250 Overview
CVE-2025-13250 is a broken access control vulnerability in WeiYe-Jing datax-web versions up to 2.1.2. The flaw affects the Job Handler component, specifically the remove, update, pause, start, and triggerJob functions. An authenticated low-privileged remote attacker can manipulate these functions to perform actions outside their authorization scope. Public exploit details have been disclosed, increasing the risk of opportunistic abuse against exposed instances. The vulnerability is classified under CWE-266: Incorrect Privilege Assignment.
Critical Impact
Authenticated remote attackers can invoke privileged job management actions in datax-web, enabling unauthorized control over scheduled data integration jobs.
Affected Products
- WeiYe-Jing datax-web versions up to and including 2.1.2
- Job Handler component (remove, update, pause, start, triggerJob functions)
- Deployments exposing the datax-web management interface to untrusted networks
Discovery Timeline
- 2025-11-16 - CVE-2025-13250 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-13250
Vulnerability Analysis
datax-web is a distributed data synchronization tool built on Alibaba's DataX. The Job Handler component exposes endpoints for managing scheduled jobs. The vulnerability stems from missing authorization checks on five job lifecycle functions: remove, update, pause, start, and triggerJob. Any authenticated user can invoke these endpoints regardless of role or job ownership. This violates the principle of least privilege and breaks role-based separation between administrators and standard users. The public disclosure of the exploit details lowers the barrier for attackers to weaponize the issue against internet-exposed deployments.
Root Cause
The root cause is improper enforcement of access control on the Job Handler endpoints. The application authenticates requests but fails to verify whether the requesting principal has the privilege to perform the requested job operation on the targeted resource. This is a classic CWE-266 condition where privilege assignment is incorrect and authorization checks are absent or insufficient at the controller layer.
Attack Vector
An attacker with valid low-privilege credentials sends HTTP requests directly to the affected Job Handler endpoints. By manipulating job identifiers in request parameters, the attacker can remove, modify, pause, start, or trigger any job in the system. No user interaction is required beyond an authenticated session. Exploitation is fully remote over the network. Technical details of the proof of concept are documented in the GitHub Report on Access Control and VulDB entry #332584.
Detection Methods for CVE-2025-13250
Indicators of Compromise
- Unexpected invocations of /jobinfo/remove, /jobinfo/update, /jobinfo/pause, /jobinfo/start, or /jobinfo/trigger endpoints by non-administrative accounts
- Job definitions modified, deleted, or triggered outside of scheduled maintenance windows
- Authenticated sessions from low-privilege accounts performing administrative job operations
- Anomalous outbound data transfers initiated by datax-web jobs that were triggered manually
Detection Strategies
- Audit datax-web application logs for Job Handler endpoint access correlated with the invoking user role
- Compare job execution history against approved change records to identify unauthorized triggers
- Alert on any non-administrator account invoking job lifecycle functions
Monitoring Recommendations
- Forward datax-web access and audit logs to a centralized SIEM for retention and correlation
- Establish baselines for job execution frequency and alert on deviations
- Monitor authentication events for low-privilege accounts that subsequently perform job state changes
- Track network egress from datax-web hosts to detect data exfiltration through manipulated jobs
How to Mitigate CVE-2025-13250
Immediate Actions Required
- Restrict network access to the datax-web management interface using firewall rules or reverse proxy allow-lists
- Audit existing datax-web user accounts and remove unused or over-privileged credentials
- Review job execution history and configurations for unauthorized changes
- Enforce strong authentication and rotate credentials for all datax-web users
Patch Information
At the time of publication, no official patch has been referenced in the NVD entry for datax-web 2.1.2 or earlier. Monitor the WeiYe-Jing datax-web GitHub repository for updated releases and review the VulDB entry for vendor response status.
Workarounds
- Place datax-web behind an authenticating reverse proxy that enforces role-based access at the gateway layer
- Apply network segmentation to limit the management interface to administrative subnets only
- Disable or remove low-privilege user accounts that do not require job management access
- Implement a web application firewall rule set to block requests to Job Handler endpoints from non-administrative IP ranges
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
