Executive brief
A security vulnerability in WukongCRM, a customer relationship management system, allows authenticated users to see internal server file paths. When a user uploads a file, the system inadvertently reveals the exact location on the server's hard drive where the file is stored. While this does not directly allow data theft, it provides attackers with a map of the server's internal structure, which can be used to plan more complex attacks like data breaches or system takeovers.
Technical details
An information disclosure vulnerability (CWE-209/CWE-200) exists in WukongCRM 11.0 within the /adminFile/upload endpoint. The root cause is an improperly configured Data Transfer Object (DTO) layer that returns the full backend entity object to the frontend instead of a sanitized version. This results in the API response containing the 'absolute file path' of the uploaded file on the server. A remote attacker with low privileges (authenticated user) can exploit this to map the server's directory structure, facilitating secondary attacks such as path traversal or local file inclusion. A public PoC has been disclosed.
Affected products
- WuKongOpenSource WukongCRM-11.0-JAVA 11.0
Timeline
- 2025-07-29: disclosed: Vulnerability reported on GitHub issues
- 2025-08-11: advisory: CVE-2025-8852 published