Executive Summary

CVE-2025-10091 is a critical XML External Entity (XXE) vulnerability in Jinher OA version 1.2, specifically in the XML Handler component at the endpoint /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add. The vulnerability occurs because the application improperly processes XML input containing external entity references, allowing attackers to craft malicious XML documents that cause the server to access and embed unauthorized external resources. This can lead to unauthorized data access and manipulation without requiring authentication. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to breaches of confidentiality, integrity, and availability. Attackers can remotely exploit it without authentication to perform out-of-band data exfiltration by forcing the server to fetch and disclose sensitive files from its filesystem. It can also enable server-side request forgery (SSRF), internal network scanning, and potentially remote code execution, putting the affected system and its data at significant risk. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for XML payloads containing DOCTYPE declarations or external entity references sent to the affected endpoint `/c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add`. Network detection can involve capturing and inspecting HTTP POST requests for XML data with external entity definitions. Additionally, Web Application Firewall (WAF) rules can be deployed to detect and block XXE attack patterns. Specific commands are not provided in the resources, but using tools like tcpdump or Wireshark to capture traffic and grep or similar tools to search for "<!DOCTYPE" or "ENTITY" in XML payloads can help identify attempts. Also, testing with proof-of-concept XML payloads that include external entity references can confirm the vulnerability. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling XML external entity processing in the XML parser configuration (e.g., setting XmlResolver to null in .NET), implementing strict input validation to reject XML documents containing DOCTYPE declarations, and restricting outbound network connections to prevent data exfiltration. Using alternative data formats like JSON where possible is recommended. Applying vendor security patches if available, deploying Web Application Firewall (WAF) rules to detect and block XXE attempts, and conducting regular security audits are also advised. If no patches are available, consider replacing the affected product with a secure alternative. [1, 3]

Useful 0 Not Useful 0