CVE-2025-4533: Jeecg Boot DOS Vulnerability

CVE-2025-4533 Overview

CVE-2025-4533 is a resource consumption vulnerability affecting JeecgBoot versions up to 3.8.0. The flaw resides in the unzipFile function exposed through the /jeecg-boot/airag/knowledge/doc/import/zip endpoint within the Document Library Upload component. Attackers can manipulate the uploaded File argument to trigger excessive resource consumption on the server. The vulnerability is exploitable remotely and has been publicly disclosed, increasing the likelihood of opportunistic abuse. JeecgBoot is a low-code development platform widely used for enterprise applications, making affected deployments a relevant target for denial-of-service attempts. The issue is tracked under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Authenticated remote attackers can submit crafted ZIP archives to the document import endpoint to exhaust server resources and degrade availability of JeecgBoot instances.

Affected Products

JeecgBoot versions up to and including 3.8.0
JeecgBoot Document Library Upload component
Deployments exposing the /jeecg-boot/airag/knowledge/doc/import/zip endpoint

Discovery Timeline

2025-05-11 - CVE-2025-4533 published to NVD
2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-4533

Vulnerability Analysis

The vulnerability stems from how the unzipFile function processes user-supplied ZIP archives during knowledge document import. The function does not adequately constrain the size, depth, or expansion ratio of archive contents before decompression. This pattern aligns with classic decompression bomb conditions, where a small input expands into disproportionately large output. Attackers exploit this asymmetry to consume disk space, memory, or CPU cycles on the target server.

The attack requires network access to the affected endpoint and elevated privileges to submit the upload. Successful exploitation results in degraded availability, with no impact on confidentiality or integrity. Publicly available discussion of the issue exists in the JeecgBoot GitHub issue tracker, allowing other actors to reproduce the condition.

Root Cause

The root cause is missing validation around archive decompression in the unzipFile routine. The component fails to enforce limits on uncompressed size, file count within the archive, or nested compression depth. Without these guardrails, a maliciously crafted ZIP file can force the server into prolonged decompression operations that monopolize finite system resources.

Attack Vector

An authenticated attacker uploads a specially crafted ZIP file through the /jeecg-boot/airag/knowledge/doc/import/zip endpoint. The archive may contain highly compressed payloads, deeply nested folder structures, or a large number of entries. When the server invokes unzipFile, the decompression process consumes disproportionate CPU, memory, or disk capacity. Repeated submissions amplify the impact and can render the application unresponsive.

No verified proof-of-concept code is available; technical details are described in the referenced GitHub issue and VulDB entry 308278.

Detection Methods for CVE-2025-4533

Indicators of Compromise

POST requests to /jeecg-boot/airag/knowledge/doc/import/zip originating from unexpected user accounts or IP ranges
ZIP file uploads with unusually high compression ratios or deeply nested directory structures
Sustained CPU, memory, or disk I/O spikes on the JeecgBoot application server correlated with import activity
Application logs showing repeated or long-running unzipFile operations

Detection Strategies

Inspect web access logs for repeated POST requests to the document import ZIP endpoint from the same session within short time windows
Monitor application server telemetry for memory or disk usage spikes that coincide with knowledge base import activity
Apply file inspection at the web gateway to flag archives with abnormal expansion ratios before they reach the application

Monitoring Recommendations

Establish baselines for normal document import volume and alert on deviations
Capture audit logs of which authenticated users invoke the import endpoint and the resulting archive sizes
Forward JeecgBoot application logs and host performance metrics to a central analytics platform for correlation

How to Mitigate CVE-2025-4533

Immediate Actions Required

Restrict access to the /jeecg-boot/airag/knowledge/doc/import/zip endpoint to trusted administrative users only
Apply rate limiting on document import requests at the reverse proxy or web application firewall layer
Enforce maximum upload size limits and reject archives that exceed expansion thresholds
Audit existing accounts with permission to import documents and revoke privileges from non-essential users

Patch Information

At the time of publication, no vendor security advisory or fixed version is listed in the available references. Monitor the JeecgBoot GitHub repository and VulDB entry 308278 for upstream remediation. Upgrade to a JeecgBoot release that explicitly addresses CVE-2025-4533 once published.

Workarounds

Disable the AI knowledge document ZIP import feature if it is not required by business workflows
Place a web application firewall rule in front of the endpoint to inspect and cap archive size before forwarding to the application
Run the JeecgBoot service under operating system resource limits (cgroups or container quotas) to contain runaway decompression
Implement archive scanning that rejects ZIP files exceeding a defined compression ratio prior to processing

bash

# Example NGINX configuration to cap upload size and rate-limit the endpoint
limit_req_zone $binary_remote_addr zone=jeecg_import:10m rate=2r/m;

location /jeecg-boot/airag/knowledge/doc/import/zip {
    client_max_body_size 10m;
    limit_req zone=jeecg_import burst=2 nodelay;
    proxy_pass http://jeecg_backend;
}