CVE-2025-5679: Tongzhouyun Agilebpm RCE Vulnerability

CVE-2025-5679 Overview

CVE-2025-5679 is an insecure deserialization vulnerability in Shenzhen Dashi Tongzhou Information Technology AgileBPM through version 2.5.0. The flaw resides in the parseStrByFreeMarker function within /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. Manipulation of the str argument triggers unsafe deserialization processing. The vulnerability is exploitable remotely and the exploit has been publicly disclosed. The issue is tracked under [CWE-20] Improper Input Validation and [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Authenticated remote attackers can submit crafted input to the parseStrByFreeMarker endpoint, leading to deserialization-based abuse against AgileBPM business process management deployments.

Affected Products

Shenzhen Dashi Tongzhou Information Technology AgileBPM versions up to and including 2.5.0
AgileBPM SysToolsController component exposing the parseStrByFreeMarker function
Deployments of tongzhouyun:agilebpm reachable over the network

Discovery Timeline

2025-06-05 - CVE-2025-5679 published to NVD
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-5679

Vulnerability Analysis

The vulnerability exists in AgileBPM's SysToolsController REST controller. The parseStrByFreeMarker function processes the str argument supplied by clients without adequate input validation. Because the function path leads to deserialization of untrusted content, attackers can craft malicious payloads that the server processes during template parsing. AgileBPM is a Java-based business process management (BPM) platform, and the FreeMarker template engine is commonly bound to server-side objects. The combination of untrusted input and deserialization logic creates the conditions described in [CWE-502]. The vulnerability is reachable over the network and requires low privileges, per the published CVSS v4.0 vector. The EPSS probability sits at 0.426% with a percentile of 33.888.

Root Cause

The root cause is the absence of input validation [CWE-20] on the str parameter before it reaches deserialization logic in parseStrByFreeMarker. The controller method accepts attacker-controlled strings and passes them into a parsing routine that can instantiate or operate on serialized objects. No allowlist or sanitization separates trusted templates from attacker-supplied content.

Attack Vector

An authenticated remote attacker sends an HTTP request to the AgileBPM endpoint backed by SysToolsController.parseStrByFreeMarker. The request includes a crafted str value containing a malicious template or serialized payload. When the server processes the request, the deserialization path executes against the attacker-controlled input. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning against exposed AgileBPM instances. For technical disclosure details, see the Gitee Issue Report and VulDB Entry #311166.

Detection Methods for CVE-2025-5679

Indicators of Compromise

HTTP POST or GET requests targeting AgileBPM endpoints that invoke SysToolsController.parseStrByFreeMarker with unusual str payloads
FreeMarker template syntax (such as <#assign>, freemarker.template.utility.Execute) appearing in request parameters
Outbound network connections initiated by the AgileBPM JVM process to unexpected hosts following template parsing
New child processes spawned by the AgileBPM application server

Detection Strategies

Inspect web access logs for requests to URLs mapped to SysToolsController and flag str parameter values containing template directives or serialized object markers
Apply web application firewall (WAF) rules that match common FreeMarker SSTI patterns and Java deserialization gadget signatures
Correlate authenticated session activity with subsequent process or network anomalies on AgileBPM servers

Monitoring Recommendations

Enable verbose logging on AgileBPM controllers handling administrative tooling endpoints
Forward application and host telemetry to a centralized analytics platform for correlation across authentication, HTTP, and process events
Monitor for unexpected JVM behavior, including reflective class loading and execution of Runtime.exec style calls

How to Mitigate CVE-2025-5679

Immediate Actions Required

Restrict network access to AgileBPM administrative interfaces and SysTools endpoints to trusted management networks only
Revoke or rotate credentials for low-privilege accounts that can reach SysToolsController if exposure is suspected
Audit AgileBPM access logs for prior invocations of parseStrByFreeMarker and review the str parameter content

Patch Information

At time of publication, no vendor patch identifier is referenced in the NVD record. Monitor the AgileBPM Gitee repository for vendor updates and apply fixes as they are released. Track VulDB #311166 for additional remediation guidance.

Workarounds

Disable or remove the parseStrByFreeMarker route if the function is not required for business operations
Place AgileBPM behind a reverse proxy or WAF that filters template injection and deserialization payloads in request parameters
Enforce strict role-based access control so that only highly trusted administrators can reach SysTools endpoints
Run the AgileBPM JVM with a Java Security Manager policy or sandboxing controls that block unexpected process execution and reflective calls

bash

# Example reverse proxy block for the vulnerable endpoint (nginx)
location ~* /sys/tools/parseStrByFreeMarker {
    deny all;
    return 403;
}