Full Report
Remote Code Execution vulnerability (CVE-2025-12140) has been found in Wirtualna Uczelnia software.
Analysis Summary
# Vulnerability: Remote Code Execution in Wirtualna Uczelnia via Eval Injection
## CVE Details
- CVE ID: CVE-2025-12140
- CVSS Score: Not explicitly provided, but RCE severity implies High
- CWE: CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
## Affected Systems
- Products: Wirtualna Uczelnia software (Vendor: Simple SA)
- Versions: All versions *before* `wu#2016.1.5513#0#20251014_113353`
- Configurations: Affects the endpoint processing the `redirectUrlParameter`.
## Vulnerability Description
The Wirtualna Uczelnia application processes the value provided in the `redirectUrlParameter` parameter within the `redirectToUrl` endpoint insecurely. The application misinterprets the input string as a Java expression and evaluates it, leading to an Eval Injection vulnerability. This allows an unauthenticated attacker to execute arbitrary code on the target system.
## Exploitation
- Status: Details not provided, but typically RCE implies potential for exploitation. (Presumed PoC available or easily developed given the technical nature).
- Complexity: Likely Low to Medium, as it allows unauthenticated RCE.
- Attack Vector: Network
## Impact
- Confidentiality: High (RCE generally allows access to sensitive data)
- Integrity: High (Ability to modify system state or application logic)
- Availability: High (Ability to cause a denial of service or complete system compromise)
## Remediation
### Patches
- Fix deployed in version: `wu#2016.1.5513#0#20251014_113353` and later.
### Workarounds
- No specific workarounds were detailed in the source material, but generally, restricting access to the affected endpoint or implementing strict input validation on `redirectUrlParameter` would be recommended until patching is complete.
## Detection
- Indicators of compromise: System process anomalies related to Java expression evaluation tracing back to HTTP requests targeting the `redirectToUrl` endpoint containing unexpected characters or structures.
- Detection methods and tools: Web Application Firewalls (WAFs) configured to block expressions or code snippets within URL parameters. Monitoring application logs for unusual evaluation attempts.
## References
- Vendor advisories: Simple SA
- Relevant links - defanged:
- https://www.cve.org/CVERecord?id=CVE-2025-12140
- https://cert.pl/en/cvd/