CVE-2025-15360: Newbee-mall-plus RCE Vulnerability

CVE-2025-15360 Overview

CVE-2025-15360 is an unrestricted file upload vulnerability in newbee-mall-plus version 2.0.0, an open-source Java-based e-commerce platform. The flaw resides in the Upload function of src/main/java/ltd/newbee/mall/controller/common/UploadController.java, which handles file submissions from the Product Information Edit Page. Authenticated attackers can manipulate the File argument to upload arbitrary content remotely. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks. The vendor was contacted prior to disclosure but did not respond. The vulnerability maps to [CWE-284] Improper Access Control and [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload arbitrary files through the product image upload endpoint, enabling potential web shell deployment and follow-on code execution within the application context.

Affected Products

newbee-ltd newbee-mall-plus 2.0.0
Component: UploadController.java in Product Information Edit Page
Function: Upload

Discovery Timeline

2025-12-30 - CVE-2025-15360 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15360

Vulnerability Analysis

The vulnerability resides in the file upload handler that backs the Product Information Edit Page of newbee-mall-plus. The Upload function in UploadController.java accepts the File parameter without enforcing sufficient validation on file type, extension, or content. An attacker holding administrative or merchant-level credentials can submit a crafted file that the server stores and serves under predictable paths. Because the application does not restrict dangerous file types, malicious files such as JSP web shells can be persisted on the server. Public disclosure of the exploit through a third-party GitHub repository lowers the barrier for adversaries to reproduce the attack.

Root Cause

The root cause is the absence of allowlist-based validation in the Upload function. The controller trusts client-supplied filenames and content types, failing to verify file magic bytes or restrict executable extensions. This combination of [CWE-434] and [CWE-284] allows authenticated users to bypass intended access controls on the upload feature.

Attack Vector

The attack is initiated remotely over the network. The adversary authenticates to the merchant or admin interface, navigates to the Product Information Edit Page, and submits an HTTP multipart/form-data request to the upload endpoint with a malicious payload disguised as a product image. After upload, the attacker accesses the stored file via its public URL to trigger execution if the file is processed by the servlet container. No verified exploit code is available; refer to the GitHub CVE Information Repository and VulDB entry #338744 for additional technical context.

Detection Methods for CVE-2025-15360

Indicators of Compromise

Unexpected files with executable extensions such as .jsp, .jspx, or .war in upload directories used by newbee-mall-plus.
Outbound network connections originating from the Java application process to unfamiliar destinations.
New administrative or merchant accounts created shortly before anomalous uploads.

Detection Strategies

Monitor HTTP POST requests to product upload endpoints for filenames or Content-Type headers that do not match expected image MIME types.
Inspect uploaded file contents for shell command patterns, Runtime.exec, or JSP scriptlet tags regardless of declared extension.
Correlate authenticated session activity from the admin interface with file write events on the server filesystem.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy or web application firewall in front of newbee-mall-plus deployments.
Alert on first-time execution of files written into web-accessible upload directories.
Track filesystem changes in upload paths using integrity monitoring tooling.

How to Mitigate CVE-2025-15360

Immediate Actions Required

Restrict access to the merchant and admin interfaces using network controls or VPN until a patch is available.
Audit existing upload directories and remove any files with executable extensions that were not placed by trusted operators.
Rotate credentials for administrative and merchant accounts that have access to the Product Information Edit Page.

Patch Information

No vendor patch is currently published. The vendor did not respond to disclosure outreach according to the public advisory. Operators should track the newbee-mall-plus project for updates and consider applying a custom fix that enforces a strict extension and MIME type allowlist in UploadController.java.

Workarounds

Configure the web server or reverse proxy to deny execution of scripts inside upload directories, for example by disabling JSP handling for /upload/ paths.
Implement a server-side allowlist that accepts only .jpg, .jpeg, .png, and .gif extensions and validates file magic bytes.
Store uploaded files outside the web root and serve them through a controlled handler that sets a non-executable Content-Type.

bash

# Example Nginx configuration to block script execution in upload paths
location ~ ^/upload/.*\.(jsp|jspx|war|sh|php)$ {
    deny all;
    return 403;
}