External risk intelligence

JSH ERP Fastjson Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51744

The vulnerability affects an ERP system which is typically deployed as a web application. ERP systems are frequently exposed to the network to support business operations, often functioning as centralized web portals for user management and data entry, making them plausible candidates for internet-facing deployment.

Deserialization

Jishenghua Jsherp

2.3.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a critical vulnerability in jishenghua JSH_ERP software that could allow unauthorized access and control if exploited. The issue lies in how the software handles user data, specifically through an endpoint that is susceptible to a common attack method. Given the nature of ERP systems, which are central to business operations, the potential impact warrants attention to confirm if this software is in use and exposed.

Software flaw allows unauthorized system access.
ERP systems are critical to business operations.
Confirm if this software is deployed and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component via the network without needing any credentials or user interaction. The exposed `/user/addUser` endpoint allows for malicious data to be sent, which the system then processes using a vulnerable library, potentially leading to full system compromise.

Exposed over the network.
Triggered by adding a user.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

The JSH_ERP system's user management endpoint could be exploited through a deserialization vulnerability. This may allow an unauthenticated attacker to execute arbitrary code, potentially impacting system integrity and confidentiality when the service is accessible over the network.

System data could be compromised.
Unauthenticated code execution may occur.
Unauthorized access and control could result.

Operational Fix

Recommended remediation, mitigation, and detection steps

The discovery of a fastjson deserialization vulnerability in jishenghua JSH_ERP signifies that application owners, potentially supported by infrastructure or platform teams, must identify all instances of this ERP system. The immediate priority is to determine the exposure and business criticality of each identified deployment to inform the remediation strategy and engage the appropriate accountable personnel for planning.

Application owners must coordinate remediation.
Verify network reachability and business criticality.
Plan for secure vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JSH_ERP?

JSH_ERP is an enterprise resource planning software developed by jishenghua. It acts as a centralized web portal, allowing organizations to manage business operations, data, and user accounts from a single interface.

What does deserialization vulnerability mean for CVE-2025-51744?

This CVE involves CWE-502, which is the Deserialization of Untrusted Data. In plain terms, the application takes complex data sent by a user and improperly reconstructs it into an object. An attacker can craft this data to trick the software into executing unauthorized commands, effectively letting them run code of their choosing on the server.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted data to the /user/addUser endpoint. Crucially, the vulnerability relies on the software processing this specific input; it is not triggered by standard, legitimate user management activities or normal data entry that does not contain malicious serialized payloads.

Do I need to worry if my JSH_ERP instance is internal?

Halo Surface Signal notes that ERP systems like this are frequently deployed as internet-facing web portals to support business operations. While the risk is highest if the software is reachable over the public internet, any deployment where the endpoint is accessible to untrusted network segments may be at risk.

When should I take action for this CVE?

You should prioritize identifying all instances of JSH_ERP 2.3.1 or earlier within your environment immediately. Since this flaw allows for unauthorized remote code execution, you should verify if your deployments are reachable over the network and work with your infrastructure teams to coordinate a remediation plan.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.