# Wirtualna Uczelnia RCE via expression injection

Published: 2025-11-27 · Severity: critical · Sectors: education
Canonical: https://vorant.io/reports/3469389a-7809-5805-b258-68ecd3abced2/wirtualna-uczelnia-rce-via-expression-injection

> An unauthenticated RCE vulnerability in Wirtualna Uczelnia software allows attackers to execute arbitrary code via Java expression injection in the redirectUrlParameter.

CERT Polska coordinated disclosure of CVE-2025-12140, a critical vulnerability in Wirtualna Uczelnia software. The flaw stems from improper processing of the 'redirectUrlParameter' in the 'redirectToUrl' endpoint, where user input is interpreted as a Java expression. This allows unauthenticated attackers to achieve arbitrary code execution on affected systems.

The vulnerability has been patched in version wu#2016.1.5513#0#20251014_113353. The issue was responsibly disclosed by Marcin Ressel and coordinated through CERT Polska's vulnerability disclosure process. Organizations running Wirtualna Uczelnia should prioritize updating to the patched version immediately.

## Mentioned in this report

- Vulnerabilities: CVE-2025-12140

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Java Process (Possible Wirtualna Uczelnia Expression Injection RCE)

ATT&CK: T1059

Detects a Java/Tomcat process spawning a command interpreter or scripting engine, consistent with post-exploitation of the Wirtualna Uczelnia redirectUrlParameter expression injection (CVE-2025-12140). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Java Process
id: f7a9e49a-aeb7-50b4-b15a-8708e8cf341e
status: experimental
description: Detects command interpreters (cmd, powershell, sh, bash) spawned directly
  from a Java/Tomcat process, which is consistent with exploitation of Java expression/OGNL
  injection vulnerabilities such as CVE-2025-12140 in Wirtualna Uczelnia.
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bash.exe
    - \sh.exe
  filter_admin:
    CommandLine|contains:
    - catalina
    - -jar deployTool
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate application server maintenance scripts invoked from Java-based deployment
  tools
- Custom Java applications intentionally shelling out for administrative tasks
level: high
```

### Java Server Process Spawning Shell on Linux (Possible Expression Injection RCE)

ATT&CK: T1059

Detects a Java process on Linux spawning /bin/sh or /bin/bash, consistent with exploitation of the Wirtualna Uczelnia redirectUrlParameter Java expression injection leading to arbitrary command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Server Process Spawning Shell on Linux
id: 6ce268c3-93cc-59d5-8d47-8bd77e4c0110
status: experimental
description: Detects a Java process (e.g. Tomcat running Wirtualna Uczelnia) spawning
  a shell interpreter, which may indicate successful exploitation of an expression
  injection vulnerability such as CVE-2025-12140.
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /java
    - /javaw
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_args:
    CommandLine|contains:
    - -c
  condition: selection_parent and selection_child and selection_args
falsepositives:
- Legitimate Java application startup scripts that invoke shell helpers
- Container entrypoint scripts wrapping Java processes
level: high
```

### Expression Injection Pattern in redirectToUrl Web Request Parameter

ATT&CK: T1190

Detects HTTP requests to the redirectToUrl endpoint containing Java/OGNL/SpEL expression injection syntax in the redirectUrlParameter value, indicative of CVE-2025-12140 exploitation attempts against Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Expression Injection Pattern in redirectToUrl Web Request Parameter
id: 0049f774-3613-5daf-9335-b2caedde90c6
status: experimental
description: Detects web requests to the redirectToUrl endpoint where the redirectUrlParameter
  contains Java expression/OGNL/SpEL syntax markers, consistent with exploitation
  of CVE-2025-12140 (Wirtualna Uczelnia RCE via expression injection).
references:
- CERT Polska CVE-2025-12140 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: redirectToUrl
  selection_payload:
    cs-uri-query|contains:
    - ${
    - T(
    - Runtime.getRuntime
    - ProcessBuilder
    - exec(
  condition: selection_endpoint and selection_payload
falsepositives:
- Automated vulnerability scanners testing for expression injection
- Legitimate URLs containing dollar-brace template characters (rare)
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-12140

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3469389a-7809-5805-b258-68ecd3abced2/wirtualna-uczelnia-rce-via-expression-injection.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup