Jishenghua JSH_ERP Fastjson Deserialization Vulnerability Leading to Remote Code Execution

A Fastjson deserialization vulnerability has been identified in Jishenghua JSH_ERP version 2.3.1. The issue arises in the '/material/getMaterialEnableSerialNumberList' endpoint, where the search query parameter is passed directly to the 'parseObject()' method. This vulnerability can be exploited to achieve remote code execution (RCE) by using JDBC payloads.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where JSH_ERP is running.

Reproduction

To reproduce this vulnerability, send a request to the '/material/getMaterialEnableSerialNumberList' endpoint with a crafted search query parameter that includes a JDBC payload. The Fastjson library will deserialize the payload, leading to remote code execution on the server.

Remediation

Users are advised to update to Jishenghua JSH_ERP version 3.6 or later, where this vulnerability has been fixed.