VORANT. Threat Intelligence Sign in Get the full feed

Wirtualna Uczelnia RCE via expression injection

critical vulnerability education

An unauthenticated RCE vulnerability in Wirtualna Uczelnia software allows attackers to execute arbitrary code via Java expression injection in the redirectUrlParameter.

CERT Polska coordinated disclosure of CVE-2025-12140, a critical vulnerability in Wirtualna Uczelnia software. The flaw stems from improper processing of the 'redirectUrlParameter' in the 'redirectToUrl' endpoint, where user input is interpreted as a Java expression. This allows unauthenticated attackers to achieve arbitrary code execution on affected systems.

The vulnerability has been patched in version wu#2016.1.5513#0#20251014_113353. The issue was responsibly disclosed by Marcin Ressel and coordinated through CERT Polska's vulnerability disclosure process. Organizations running Wirtualna Uczelnia should prioritize updating to the patched version immediately.

Mentioned in this report

Vulnerabilities CVE-2025-12140

Detection guidance

Suspicious Child Process Spawned by Java Process (Possible Wirtualna Uczelnia Expression Injection RCE)

ATT&CK T1059

Detects a Java/Tomcat process spawning a command interpreter or scripting engine, consistent with post-exploitation of the Wirtualna Uczelnia redirectUrlParameter expression injection (CVE-2025-12140). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Java Process
id: f7a9e49a-aeb7-50b4-b15a-8708e8cf341e
status: experimental
description: Detects command interpreters (cmd, powershell, sh, bash) spawned directly
  from a Java/Tomcat process, which is consistent with exploitation of Java expression/OGNL
  injection vulnerabilities such as CVE-2025-12140 in Wirtualna Uczelnia.
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bash.exe
    - \sh.exe
  filter_admin:
    CommandLine|contains:
    - catalina
    - -jar deployTool
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate application server maintenance scripts invoked from Java-based deployment
  tools
- Custom Java applications intentionally shelling out for administrative tasks
level: high

Java Server Process Spawning Shell on Linux (Possible Expression Injection RCE)

ATT&CK T1059

Detects a Java process on Linux spawning /bin/sh or /bin/bash, consistent with exploitation of the Wirtualna Uczelnia redirectUrlParameter Java expression injection leading to arbitrary command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Server Process Spawning Shell on Linux
id: 6ce268c3-93cc-59d5-8d47-8bd77e4c0110
status: experimental
description: Detects a Java process (e.g. Tomcat running Wirtualna Uczelnia) spawning
  a shell interpreter, which may indicate successful exploitation of an expression
  injection vulnerability such as CVE-2025-12140.
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /java
    - /javaw
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_args:
    CommandLine|contains:
    - -c
  condition: selection_parent and selection_child and selection_args
falsepositives:
- Legitimate Java application startup scripts that invoke shell helpers
- Container entrypoint scripts wrapping Java processes
level: high

Expression Injection Pattern in redirectToUrl Web Request Parameter

ATT&CK T1190

Detects HTTP requests to the redirectToUrl endpoint containing Java/OGNL/SpEL expression injection syntax in the redirectUrlParameter value, indicative of CVE-2025-12140 exploitation attempts against Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Expression Injection Pattern in redirectToUrl Web Request Parameter
id: 0049f774-3613-5daf-9335-b2caedde90c6
status: experimental
description: Detects web requests to the redirectToUrl endpoint where the redirectUrlParameter
  contains Java expression/OGNL/SpEL syntax markers, consistent with exploitation
  of CVE-2025-12140 (Wirtualna Uczelnia RCE via expression injection).
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: redirectToUrl
  selection_payload:
    cs-uri-query|contains:
    - ${
    - T(
    - Runtime.getRuntime
    - ProcessBuilder
    - exec(
  condition: selection_endpoint and selection_payload
falsepositives:
- Automated vulnerability scanners testing for expression injection
- Legitimate URLs containing dollar-brace template characters (rare)
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-12140

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free