CVE-2025-8963: Jeecg Jimureport RCE Vulnerability

CVE-2025-8963 Overview

CVE-2025-8963 is an insecure deserialization vulnerability in jeecgboot JimuReport versions up to 2.1.1. The flaw resides in the /drag/onlDragDataSource/testConnection endpoint of the Data Large Screen Template component. Attackers can manipulate untrusted input that the application deserializes, allowing remote exploitation across the network. The vendor confirmed the issue through a GitHub issue report and stated the code was "Modified, next version updated". The weaknesses map to [CWE-20] Improper Input Validation and [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Authenticated remote attackers can submit crafted serialized payloads to the testConnection endpoint, potentially leading to data tampering and integrity loss within the JimuReport reporting platform.

Affected Products

jeecgboot JimuReport versions up to and including 2.1.1
Data Large Screen Template component
Deployments exposing the /drag/onlDragDataSource/testConnection endpoint

Discovery Timeline

2025-08-14 - CVE-2025-8963 published to the National Vulnerability Database (NVD)
2025-10-17 - Last updated in NVD database

Technical Details for CVE-2025-8963

Vulnerability Analysis

JimuReport is an open-source reporting and data visualization tool maintained by the jeecgboot project. The Data Large Screen Template component exposes a testConnection handler under /drag/onlDragDataSource/. This handler accepts user-supplied data that is processed through a deserialization routine without sufficient validation.

When an application deserializes attacker-controlled input, it can instantiate arbitrary object graphs. In Java-based applications such as JimuReport, this commonly leads to gadget chain execution using libraries available on the classpath. The vendor response on the GitHub issue tracker indicates a fix has been committed for the next release.

Root Cause

The root cause is the absence of strict type filtering and input validation on data received by the testConnection endpoint. The endpoint trusts client-supplied serialized content during a data source connectivity check, conflating connectivity testing with object reconstruction. [CWE-502] applies because untrusted data flows into a deserialization sink, and [CWE-20] applies because the parameters are not properly constrained before processing.

Attack Vector

The vulnerability is reachable over the network and requires low-level privileges to submit a request to the targeted endpoint. An attacker authenticates against the JimuReport instance, then sends a POST request to /drag/onlDragDataSource/testConnection containing a malicious serialized payload. Successful exploitation produces limited impact to confidentiality, integrity, and availability within the application context.

No verified proof-of-concept code is currently published. Refer to the GitHub Issue Discussion and the VulDB entry #319958 for technical details and vendor commentary.

Detection Methods for CVE-2025-8963

Indicators of Compromise

HTTP POST requests to /drag/onlDragDataSource/testConnection containing serialized object markers such as rO0AB (Base64-encoded Java serialization header) or aced0005 (hex magic bytes).
Unexpected child processes spawned by the JimuReport Java process, including shell interpreters or scripting runtimes.
Outbound network connections initiated by the JimuReport JVM to unfamiliar external hosts shortly after requests to the affected endpoint.

Detection Strategies

Inspect web server and application access logs for requests to /drag/onlDragDataSource/testConnection and correlate with authentication events.
Deploy web application firewall rules that flag serialized Java payload signatures in POST bodies targeting JimuReport URIs.
Hunt for anomalous process lineage from the JimuReport application server, particularly Java spawning sh, bash, cmd.exe, or powershell.exe.

Monitoring Recommendations

Log and retain full request bodies for the affected endpoint to enable forensic analysis of payload content.
Monitor JVM memory and CPU spikes coinciding with calls to the Data Large Screen Template feature.
Alert on outbound DNS or HTTP traffic from the JimuReport host to non-allowlisted destinations.

How to Mitigate CVE-2025-8963

Immediate Actions Required

Upgrade JimuReport beyond version 2.1.1 once the vendor publishes the next release containing the fix referenced in the GitHub issue.
Restrict network access to the JimuReport administrative interface using firewall rules or reverse proxy allowlists.
Audit user accounts on JimuReport instances and remove unused or low-trust accounts that could be leveraged to reach the authenticated endpoint.

Patch Information

The vendor acknowledged the report on the GitHub Issue Discussion and indicated the modification will ship in the next version. Administrators should track the jeecgboot/jimureport repository for release notes referencing the onlDragDataSource component and apply the patched build as soon as it is available.

Workarounds

Block external access to /drag/onlDragDataSource/testConnection at the reverse proxy or WAF layer until a patched version is deployed.
Apply request body inspection rules that drop POSTs containing Java serialization magic bytes (0xaced0005) destined for JimuReport URIs.
Run the JimuReport service under a least-privilege account to limit the scope of impact if exploitation succeeds.

bash

# Example nginx configuration to block the vulnerable endpoint
location /drag/onlDragDataSource/testConnection {
    deny all;
    return 403;
}