Xuxueli xxl-job CVE-2025-7787

Exploitation requires the following specific conditions: (1) an authenticated user account on the xxl-job platform (PR:L in CVSS vector); (2) the httpJobHandler job type must be available and not explicitly disabled; (3) the xxl-job executor must have network access to internal resources or cloud metadata endpoints that the attacker wishes to target; (4) the job definition interface must be accessible to the attacker (either directly or via a compromised credential). Exploitation is NOT possible against default installations if: network-level segmentation prevents the executor from reaching internal services, the httpJobHandler is explicitly removed or disabled, or strong access controls are enforced on the job definition API. The vulnerability does not require elevated privileges on the xxl-job process itself or any special system configuration, only valid authenticated credentials.

This vulnerability presents a moderate real-world risk despite its low CVSS score of 2.1. The CVSS vector indicates authentication is required (PR:L) and impact is limited to confidentiality (VC:L/VI:L/VA:L), but several factors elevate practical risk: (1) the EPSS score of 0.13% (32nd percentile) suggests low widespread exploitation probability, yet this reflects only early disclosure statistics; (2) publicly available exploit code exists, lowering the barrier to weaponization; (3) xxl-job's use in job scheduling infrastructure means compromised instances can be leveraged for lateral movement and reconnaissance of internal networks; (4) the attack vector is network-accessible (AV:N/AC:L) with low attack complexity. The discrepancy between the critical classification in the description and the low CVSS score (2.1) appears to reflect a downgrade following vendor assessment. Organizations running xxl-job with exposed job definition endpoints or weak credential controls should treat this as a priority fix. The real risk depends on deployment: isolated internal deployments with strong access controls face minimal risk, while xxl-job instances accessible to untrusted users or with default credentials present elevated risk.

An authenticated attacker with access to xxl-job's job definition interface creates a scheduled job that uses the vulnerable httpJobHandler with a malicious URL pointing to an internal service (e.g., http://localhost:8080/admin or http://169.254.169.254/latest/meta-data/ on cloud deployments). When the job executes on the xxl-job executor node, the handler makes the HTTP request on the executor's behalf, returning responses containing sensitive data (cloud credentials, internal API responses, or application configuration) that the attacker cannot directly access from their network position. Publicly available exploit code accelerates weaponization of this attack pattern.