Executive Summary

CVE-2025-10394 is a Remote Code Execution (RCE) vulnerability in the Scheduled Task Module of the fcba_zzm ics-park Smart Park Management System version 2.0. It occurs because the system does not validate or restrict the method string specified when creating or updating scheduled tasks, specifically in the file JobController.java. An attacker with administrative access can supply arbitrary method calls, such as dangerous YAML deserialization methods, which the scheduler executes directly without security checks. This allows the attacker to inject and execute arbitrary code remotely on the server. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full remote code execution on the affected server, allowing attackers to fully compromise the system. Potential impacts include unauthorized manipulation or destruction of business data and logic, exposure of sensitive information, privilege escalation, and lateral movement within the internal network. The attacker can execute arbitrary code with the server's privileges, severely affecting the confidentiality, integrity, and availability of the system. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /api/monitor/job/save that include unusual or dangerous method strings in the invokeTarget parameter, such as calls to org.yaml.snakeyaml.Yaml.load or other unexpected method invocations. Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Additionally, reviewing scheduled tasks created or updated in the system for any invokeTarget values that do not match a whitelist of safe methods can help detect exploitation attempts. Specific commands depend on your environment, but for example, you can use curl to simulate or detect suspicious requests: curl -X POST https://yourserver/api/monitor/job/save -d '{"invokeTarget":"org.yaml.snakeyaml.Yaml.load(...)"}' -H 'Content-Type: application/json'. Also, inspecting application logs for unexpected method calls or errors related to task scheduling may help identify exploitation. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing a whitelist to restrict scheduled task execution only to a predefined set of safe and explicitly allowed methods, thereby preventing arbitrary method invocation. Enhance input validation and sanitization on the endpoints responsible for creating or updating scheduled tasks, especially validating the invokeTarget parameter to reject unsafe or unrecognized method strings. Users should upgrade to the latest secure version of the RuoYi framework where this vulnerability is fixed or apply official security patches once available. Until patches are applied, restrict administrative access to the scheduling module and monitor for suspicious activity related to task creation or updates. [1, 2]

Useful 0 Not Useful 0