CVE-2025-5680: Tongzhouyun Agilebpm RCE Vulnerability

CVE-2025-5680 Overview

CVE-2025-5680 affects Shenzhen Dashi Tongzhou Information Technology AgileBPM through version 2.5.0. The vulnerability resides in the executeScript function within /src/main/java/com/dstz/sys/rest/controller/SysScriptController.java, part of the Groovy Script Handler component. Attackers can manipulate the script argument to trigger insecure deserialization [CWE-502] and improper input validation [CWE-20]. The flaw is exploitable remotely and the exploit has been disclosed publicly.

Critical Impact
Remote authenticated attackers can submit crafted Groovy script input to the executeScript endpoint, triggering deserialization that can lead to arbitrary code paths within the AgileBPM application.

Affected Products

Tongzhouyun AgileBPM versions up to and including 2.5.0
Component: Groovy Script Handler (SysScriptController.java)
Affected function: executeScript

Discovery Timeline

2025-06-05 - CVE-2025-5680 published to the National Vulnerability Database
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-5680

Vulnerability Analysis

The vulnerability exists in AgileBPM's administrative scripting subsystem. The executeScript method in SysScriptController.java accepts a user-supplied script parameter and processes it through the Groovy Script Handler. Because the handler deserializes attacker-controlled input without sufficient validation, an authenticated remote user can drive the deserialization process to execute unintended logic within the Java Virtual Machine context.

The weakness combines two CWE categories. CWE-502 covers the unsafe deserialization of untrusted data, while CWE-20 reflects the absence of input validation on the script parameter. Groovy script evaluation in Java environments is a well-known sink for code execution because Groovy supports arbitrary class loading and method invocation at runtime.

According to the EPSS model, this CVE has an exploitation probability of 0.897% at the 76th percentile, indicating notable interest relative to the broader CVE population.

Root Cause

The root cause is the direct evaluation of untrusted script content received over HTTP. The controller passes the script argument into a Groovy execution context without sandboxing, allow-listing, or stripping of dangerous constructs. Deserialization gadgets reachable from the Groovy runtime can then be invoked through script syntax.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker sends an HTTP request to the endpoint mapped to executeScript with a malicious Groovy payload in the script parameter. The server-side handler evaluates the payload, processing serialized objects or invoking sensitive Java APIs. Public disclosure of the exploit technique increases the risk of opportunistic abuse.

No verified proof-of-concept code is included in the NVD record. Refer to the Gitee Issue ICAPT5 Report and VulDB entry #311167 for technical context.

Detection Methods for CVE-2025-5680

Indicators of Compromise

HTTP POST requests to AgileBPM endpoints invoking SysScriptController.executeScript containing Groovy keywords such as Runtime.getRuntime, ProcessBuilder, or ObjectInputStream in the script parameter.
Unexpected child processes spawned by the AgileBPM Java application server (Tomcat, Jetty) following script execution requests.
Outbound network connections from the AgileBPM host to unknown infrastructure after authenticated script API usage.

Detection Strategies

Enable verbose application logging on the SysScriptController class and forward logs to a centralized analytics platform for inspection.
Inspect web server access logs for authenticated requests targeting the script execution route, correlating user identity with payload size and frequency.
Apply web application firewall rules that flag Groovy reflection patterns, Java serialization magic bytes (AC ED 00 05), and base64-encoded class references in request bodies.

Monitoring Recommendations

Monitor JVM process trees for unexpected child processes such as shells, scripting interpreters, or network utilities originating from the AgileBPM server.
Track authentication events on AgileBPM administrative accounts and alert on access from unusual source addresses or geographies.
Baseline normal usage of the script handler endpoint and alert on deviations in request volume, payload size, or response time.

How to Mitigate CVE-2025-5680

Immediate Actions Required

Restrict network access to AgileBPM administrative interfaces using firewall rules or reverse proxy allow-lists.
Disable or remove the Groovy Script Handler functionality if it is not required for business operations.
Audit all accounts with privileges to call the executeScript endpoint and revoke unnecessary access.
Review historical web server logs for prior requests to the affected endpoint and investigate any anomalies.

Patch Information

No official vendor patch is referenced in the NVD record at the time of publication. Track remediation status through the Gitee Issue ICAPT5 Report and apply vendor updates as they become available. Users running AgileBPM 2.5.0 or earlier should plan an upgrade to a fixed release once published.

Workarounds

Place AgileBPM behind a web application firewall configured to block Groovy execution patterns and Java serialization signatures in request bodies.
Enforce strong, role-based access control on the script management endpoints and require multi-factor authentication for administrative users.
Run the AgileBPM application server under a least-privilege operating system account to limit the impact of successful exploitation.
Apply egress filtering on the application server to block outbound connections that script-driven payloads typically rely on.

bash

# Example reverse proxy rule to block direct access to the vulnerable endpoint
# nginx configuration snippet
location ~* /sys/script/executeScript {
    allow 10.0.0.0/8;        # internal administration network only
    deny all;
    return 403;
}