CVE-2025-2622
Published: 22 March 2025
Summary
CVE-2025-2622 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Aizuda Snail-Job. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-2622 is a critical deserialization vulnerability in aizuda snail-job version 1.4.0, affecting the getRuntime function within the /snail-job/workflow/check-node-expression endpoint of the Workflow-Task Management Module. By manipulating the nodeExpression argument, an attacker can trigger deserialization of untrusted data, as classified under CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-22.
An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution or denial-of-service within the scope of the workflow task management component.
Advisories and further details are available in referenced sources, including Gitee issue tracker entries at https://gitee.com/aizuda/snail-job/issues/IBSQ24 and related notes, as well as VulDB entries at https://vuldb.com/?ctiid.300624, https://vuldb.com/?id.300624, and https://vuldb.com/?submit.518999. The exploit has been publicly disclosed and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7298
Vulnerability details
A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is…
more
possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-2622 enables remote code execution via SpEL injection in the workflow node expression validation endpoint of snail-job, facilitating exploitation of public-facing web applications (T1190) and template injection (T1221).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly and comprehensively mitigates the CVE by enforcing validation of the nodeExpression input to block deserialization of untrusted data (CWE-20, CWE-502).
SI-2 comprehensively addresses the CVE through timely identification, reporting, and patching of the deserialization flaw in the getRuntime function.
SI-16 comprehensively protects against the CVE's impacts by safeguarding system memory from unauthorized code execution triggered by deserialized malicious payloads.