Cyber Resilience

CVE-2025-2622

MediumPublic PoC

Published: 22 March 2025

Published
22 March 2025
Modified
26 March 2025
KEV Added
Patch
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0011 28.6th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2622 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Aizuda Snail-Job. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-2622 is a critical deserialization vulnerability in aizuda snail-job version 1.4.0, affecting the getRuntime function within the /snail-job/workflow/check-node-expression endpoint of the Workflow-Task Management Module. By manipulating the nodeExpression argument, an attacker can trigger deserialization of untrusted data, as classified under CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-22.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution or denial-of-service within the scope of the workflow task management component.

Advisories and further details are available in referenced sources, including Gitee issue tracker entries at https://gitee.com/aizuda/snail-job/issues/IBSQ24 and related notes, as well as VulDB entries at https://vuldb.com/?ctiid.300624, https://vuldb.com/?id.300624, and https://vuldb.com/?submit.518999. The exploit has been publicly disclosed and may be used by attackers.

EU & UK References

Vulnerability details

A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is…

more

possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1221 Template Injection Stealth
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.
Why these techniques?

CVE-2025-2622 enables remote code execution via SpEL injection in the workflow node expression validation endpoint of snail-job, facilitating exploitation of public-facing web applications (T1190) and template injection (T1221).

CVEs Like This One

CVE-2025-1556Shared CWE-20, CWE-502
CVE-2025-0465Shared CWE-20, CWE-502
CVE-2025-2376Shared CWE-20, CWE-502
CVE-2025-1113Shared CWE-20, CWE-502
CVE-2025-2689Shared CWE-20, CWE-502
CVE-2025-1177Shared CWE-20, CWE-502
CVE-2024-13136Shared CWE-20, CWE-502
CVE-2025-0734Shared CWE-20, CWE-502
CVE-2025-2855Shared CWE-20, CWE-502
CVE-2025-1186Shared CWE-20, CWE-502

Affected Assets

aizuda
snail-job
1.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-10 directly and comprehensively mitigates the CVE by enforcing validation of the nodeExpression input to block deserialization of untrusted data (CWE-20, CWE-502).

prevent

SI-2 comprehensively addresses the CVE through timely identification, reporting, and patching of the deserialization flaw in the getRuntime function.

prevent

SI-16 comprehensively protects against the CVE's impacts by safeguarding system memory from unauthorized code execution triggered by deserialized malicious payloads.

References