CVE-2025-34040: Zhiyuan OA Platform RCE Vulnerability

CVE-2025-34040 Overview

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal sequences. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.

Critical Impact

This vulnerability allows unauthenticated remote code execution through arbitrary JSP file uploads, potentially leading to complete system compromise of affected Zhiyuan OA deployments.

Affected Products

• Zhiyuan OA Platform (Seeyon OA)
• Versions with vulnerable wpsAssistServlet interface
• Enterprise deployments utilizing the affected file upload functionality

Discovery Timeline

• 2025-06-24 - CVE CVE-2025-34040 published to NVD
• 2025-11-20 - Last updated in NVD database

Technical Details for CVE-2025-34040

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal) combined with unrestricted file upload capabilities. The core issue resides in the wpsAssistServlet interface, which handles multipart file upload requests without properly sanitizing user-supplied parameters.

The realFileType parameter accepts arbitrary file extension values, bypassing file type restrictions designed to prevent dangerous file uploads. Simultaneously, the fileId parameter fails to adequately filter path traversal sequences (such as ../), enabling attackers to specify arbitrary destination paths outside the intended upload directory.

When an attacker combines these two flaws, they can upload a malicious JSP webshell to a web-accessible directory. Once uploaded, the attacker can directly access the JSP file through the web server, achieving remote code execution with the privileges of the web application.

Root Cause

The root cause stems from insufficient input validation on two critical parameters within the wpsAssistServlet endpoint:

1. File Type Validation Bypass: The realFileType parameter is not validated against an allowlist of safe file extensions, permitting JSP and other executable file types to be uploaded.

2. Path Traversal in fileId: The fileId parameter does not properly sanitize directory traversal sequences, allowing attackers to escape the intended upload directory and write files to arbitrary locations within the filesystem accessible to the web application process.

Attack Vector

The attack is network-based and requires no authentication, making it particularly dangerous for internet-facing Zhiyuan OA deployments. An attacker constructs a specially crafted multipart HTTP POST request to the /seeyon/wpsAssistServlet endpoint containing:

The malicious request includes path traversal sequences in the fileId parameter to navigate to a web-accessible directory, a .jsp file extension in the realFileType parameter, and a JSP webshell payload in the file content. Upon successful upload, the attacker accesses the uploaded JSP file directly through the web server to execute arbitrary commands. For detailed technical analysis, refer to the VulnCheck Path Traversal Advisory and the CNBlogs Security Analysis.

Detection Methods for CVE-2025-34040

Indicators of Compromise

• HTTP POST requests to /seeyon/wpsAssistServlet containing path traversal sequences such as ../ in request parameters
• Newly created JSP files in web-accessible directories outside of designated upload folders
• Unexpected JSP files with random or obfuscated names appearing in the webroot or application directories
• Web server access logs showing direct requests to unfamiliar JSP files shortly after upload requests

Detection Strategies

• Monitor HTTP traffic for multipart requests to wpsAssistServlet containing .. sequences in the fileId parameter
• Implement file integrity monitoring on web-accessible directories to detect unauthorized JSP file creation
• Deploy web application firewall (WAF) rules to block requests containing path traversal patterns targeting the vulnerable endpoint
• Analyze web server logs for patterns indicating webshell deployment and subsequent command execution

Monitoring Recommendations

• Enable detailed logging on the Zhiyuan OA application to capture all file upload activities with full parameter values
• Configure SIEM alerts for path traversal patterns in HTTP request parameters targeting Seeyon/Zhiyuan endpoints
• Implement real-time file system monitoring to detect new executable files in web directories
• Regularly audit uploaded files and compare against known-good baselines

How to Mitigate CVE-2025-34040

Immediate Actions Required

• Apply the vendor security patch from the Seeyon Security Patch List immediately
• Restrict network access to the wpsAssistServlet endpoint using firewall rules or web server configurations
• Conduct a forensic review of uploaded files to identify any existing webshells or malicious content
• Review web server access logs for evidence of exploitation attempts

Patch Information

The vendor (Seeyon) has released security patches addressing this vulnerability. Organizations should obtain the latest security updates from the official Seeyon Security Patch List. The vulnerability was also documented in CNVD #2021-01627, indicating earlier awareness of similar issues in the platform.

Workarounds

• Block access to /seeyon/wpsAssistServlet at the web server or WAF level if the functionality is not required
• Implement strict allowlist validation for file extensions on file upload endpoints at the network perimeter
• Deploy network segmentation to limit exposure of the Zhiyuan OA platform to trusted networks only
• Configure web server to prevent execution of JSP files in upload directories as an additional defense layer

# Example: Block access to vulnerable endpoint via Apache configuration
<Location "/seeyon/wpsAssistServlet">
    Require all denied
</Location>

# Example: Nginx configuration to block the endpoint
location /seeyon/wpsAssistServlet {
    deny all;
    return 403;
}