External risk intelligence

JSH_ERP Fastjson Deserialization Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51742

JSH_ERP is an enterprise resource planning software typically deployed as a web application. The vulnerability exists within an API endpoint accessible via the web interface. Because such business management platforms are commonly exposed to provide access to authorized users across the network or internet, this endpoint is likely to be reachable in common deployments.

Deserialization

Jishenghua Jsherp

2.3.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in jishenghua JSH_ERP software, specifically related to how it handles data processing. This issue could allow unauthorized access and control over systems using the affected software due to insecure deserialization of data. The primary concern is confirming if our environment utilizes this specific software and version, and if so, assessing the potential exposure.

Software flaws allow remote system compromise.
Critical systems could be at risk if exposed.
Confirm relevance and potential exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending a specially crafted request to a web API endpoint. This endpoint, designed to retrieve material information, is exposed externally and requires no authentication or user interaction to trigger. If successful, the vulnerability allows an attacker to execute arbitrary code on the server.

Accessible via network.
Triggered by API request parameter.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server when the affected endpoint processes a specially crafted request. This could impact the integrity and availability of the JSH_ERP application and its underlying system, when accessible over a network.

Server-side code execution.
Network requests trigger deserialization.
Compromise of application and system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The jishenghua JSH_ERP application, specifically version 2.3.1, contains a critical Fastjson deserialization vulnerability that allows for Remote Code Execution (RCE). This vulnerability is accessible via the `/material/getMaterialEnableSerialNumberList` endpoint and can be exploited through JDBC payloads. Identifying where this application is deployed, confirming its reachability and business criticality, and assigning ownership are the crucial first steps. Subsequently, a risk-based remediation plan should be developed, which may involve coordinating with the vendor or implementing temporary risk reduction measures if immediate patching is not feasible.

Application owners should lead remediation efforts.
Verify JSH_ERP deployment reachability and criticality.
Plan and coordinate vendor-assisted patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is jishenghua JSH_ERP?

JSH_ERP is an enterprise resource planning platform used by businesses to manage internal operations like inventory and material tracking. It functions as a web-based application, providing a centralized interface for administrative tasks and data management within an organization.

What does CWE-502 mean for CVE-2025-51742?

CWE-502, or Deserialization of Untrusted Data, refers to a weakness where an application processes data from an outside source without sufficient validation. In this CVE, the software incorrectly trusts input passed to a specific API, which can allow the system to execute unauthorized commands or code.

How is the vulnerability triggered?

The flaw is triggered when a specially crafted request is sent to the /material/getMaterialEnableSerialNumberList endpoint. The issue is specific to how this endpoint handles incoming parameters; simply accessing the application home page or using other non-vulnerable API endpoints does not activate this specific path.

Is my instance of JSH_ERP at risk?

According to Halo Surface Signal, this software is typically deployed as a web application, making its API endpoints reachable over a network. If your JSH_ERP instance is accessible to users—especially if it can be reached via the internet—it may be exposed to these unauthorized requests, regardless of whether it is intended for public or internal use.

What should I do if I run this software?

First, locate and identify all running instances of JSH_ERP version 2.3.1 within your environment. Once identified, evaluate the network accessibility of these systems and coordinate with your internal teams or the vendor to plan for a secure update or the implementation of protective measures to restrict access to the affected endpoint.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.