External risk intelligence

JSH_ERP fastjson Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51745

JSH_ERP is an enterprise resource planning software typically deployed as a web application. Such applications are commonly configured as internet-facing portals to support remote access, business operations, and external API connectivity, making the underlying web endpoints reachable from the public internet in many standard deployment scenarios.

Deserialization

Jishenghua Jsherp

2.3.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the JSH_ERP software, specifically its role management functions. The issue allows for potentially severe system compromise through network-accessible endpoints, impacting confidentiality, integrity, and availability. The main concern is confirming its relevance and exposure within our environment.

ERP system has a critical flaw.
It enables broad system compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the JSH_ERP application over the network without needing any credentials. By sending a specially crafted request to the `/role/addcan` endpoint, they can trigger a deserialization vulnerability. This vulnerability allows the attacker to execute arbitrary code on the system, potentially leading to a complete compromise.

No authentication required.
Triggered by an API request.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in jishenghua JSH_ERP could allow an unauthenticated attacker to execute arbitrary code on the server by sending a specially crafted request to the `/role/addcan` endpoint. This attack leverages a fastjson deserialization weakness, potentially affecting the integrity and availability of the application.

Server-side code execution.
Unauthenticated network request.
Compromise of application integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address the deserialization vulnerability in JSH_ERP, application owners and infrastructure teams should coordinate. The first practical step involves identifying all instances of JSH_ERP, determining their exposure and criticality, and then planning remediation based on business risk.

Application owners should confirm ownership.
Verify JSH_ERP instances and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JSH_ERP?

JSH_ERP is an enterprise resource planning software developed by jishenghua. It is used to manage core business processes, such as resource planning and administrative operations, and is typically deployed as a web application to support organizational workflows.

What is a fastjson deserialization vulnerability in CVE-2025-51745?

This is a weakness classified as CWE-502. It occurs when an application improperly transforms incoming data into objects without sufficient validation. In this CVE, the software incorrectly processes untrusted data sent to the /role/addcan endpoint, which can allow an attacker to execute unintended, arbitrary code on the underlying server.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending a specially crafted request to the /role/addcan endpoint within the JSH_ERP application. Crucially, the system does not require any prior authentication or valid credentials to process the request, meaning the flaw can be accessed directly by an external party.

Is my instance of JSH_ERP at risk?

If you are running JSH_ERP version 2.3.1 or earlier, you are potentially affected. According to Halo Surface Signal, this software is frequently deployed as an internet-facing portal to facilitate remote business access, which often makes these specific web endpoints reachable from the public internet.

How should I respond to this threat?

Begin by identifying all JSH_ERP instances currently deployed within your infrastructure. Once identified, evaluate their specific network exposure and business criticality. Coordinate with your application and infrastructure teams to prioritize these instances and plan the necessary steps to remediate the vulnerability based on your organizational risk assessment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.