zephyr1ng/cve-2025-60423Analyzes CVE-2025-60423, an authentication bypass in JEECG versions 7.2.8 and 7.2.9, detailing path traversal and URL encoding techniques to bypass filters and access protected endpoints.
This authentication bypass is similar to Shiro's permission bypass.
In the dofilterInternal method of the sessionfilter class, the default dofilter parameter is true, and only when it is false can authentication be bypassed.
Following into the matches method, this code matches the URL against 134 path strings in patterns. When a match succeeds, it returns true, which sets dofilter to .
Then keep debugging until the loop enters the judgment. At this point, the pattern is .
true
/static.*?
/static.*?:
This is a non-greedy regex that matches strings starting with /static, followed by any characters (including /, ., etc.). (.*? matches any characters; the non-greedy mode only affects the match length, not whether it matches)./static/../je/saas/saasYh/getInfoById — this string clearly starts with /static, and the subsequent content contains /../je/..., which falls within the matching scope of /static.*?.So simply prepending /static/.. to any backend directory path bypasses authentication.
Actually, it's not just /static/.. that works here. In patterns, any single-level path followed by .*? can be used to bypass.
Example:
/error/.*?
/adminseal.zz/.*?
/dwr/.*?
...
I haven't found them all, but anything matching this rule works.
In the new version 7.2.9, an additional URL check step was added.
Following into checkErrorUrl, it checks whether .. exists.
Still combining the Shiro CVE bypass ideas, URL-encoding .. once successfully bypasses the check.
Payload:
POST /static/%2e%2e/je/sysConfig/sysConfig/loadSysVariables HTTP/1.1 1
Leaks unencrypted passwords from the web side.
