CVE-2025-0399
Published: 12 January 2025
Summary
CVE-2025-0399 is a medium-severity Improper Access Control (CWE-284) vulnerability in Starsea99 Starsea-Mall. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-0399 is a critical vulnerability in StarSea99 starsea-mall version 1.0 that enables unrestricted file upload. It affects the UploadController function in the file src/main/java/com/siro/mall/controller/common/uploadController.java, where manipulation of the 'file' argument allows attackers to upload arbitrary files. The issue is remotely exploitable and has been assigned CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with high privileges (PR:H) can exploit this vulnerability by submitting a malicious 'file' argument to the UploadController, leading to unrestricted file upload. Successful exploitation results in low-level impacts on confidentiality, integrity, and availability, potentially allowing limited data exposure, modification, or disruption depending on the uploaded file's nature and server configuration.
Advisories and details are documented in the StarSea99/starsea-mall GitHub repository issues #3 and #3#issue-2765550309, as well as on VulDB entries at ctiid.291274, id.291274, and submit.473319, where the public disclosure of the exploit is noted.
The exploit has been publicly disclosed, increasing the risk of targeted attacks against deployments requiring high-privilege access.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1646
Vulnerability details
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web app directly enables T1190 exploitation and facilitates T1105 tool ingress plus T1505.003 web shell deployment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly mitigates unrestricted file upload by requiring validation and sanitization of the 'file' argument in UploadController to block dangerous files (CWE-434).
AC-3 enforces proper access controls on the UploadController, addressing improper access control that allows high-privilege attackers to upload arbitrary files (CWE-284).
SI-9 restricts file types, sizes, and sources for uploads, preventing exploitation via manipulation of the 'file' argument with dangerous content.