CVE-2025-14674: 
Java vulnerability analysis and mitigation

CVE-2025-14674 is a code injection vulnerability in the QLExpressEngine.doEval function of aizuda snail-job, a distributed task retry and scheduling framework. It affects all versions of snail-job up to and including 1.6.0 (Maven package com.aizuda:snail-job). The vulnerability was disclosed on December 14, 2025, and is assigned a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) by VulDB (GitHub Advisory, VulDB).

The root cause is improper neutralization of special elements in the QLExpressEngine.doEval function located in snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java, classified as CWE-74 (Injection) and CWE-707 (Improper Neutralization) (GitHub Advisory). The function evaluates QLExpress expressions (a Java-based scripting engine) without adequately sanitizing attacker-controlled input, allowing malicious expressions to be injected and executed server-side. Exploitation requires low-privilege authenticated access and can be performed remotely over the network with no user interaction required. The fix is identified in commit 978f316c38b3d68bb74d2489b5e5f721f6675e86 on the project's Gitee repository (Gitee Commit).

Successful exploitation allows a low-privileged remote attacker to inject and execute arbitrary code within the application context of the snail-job server, resulting in limited but meaningful impacts to confidentiality, integrity, and availability. An attacker could access or modify sensitive job scheduling data, tamper with retry logic or task configurations, and partially disrupt service availability. The scope is limited to the vulnerable system itself, with no direct subsequent system impact indicated by the CVSS scoring (GitHub Advisory, VulDB).

1. Reconnaissance: Identify internet-facing or internally accessible snail-job instances running versions up to 1.6.0 using network scanning tools or by inspecting Maven dependency manifests for com.aizuda:snail-job.
2. Obtain low-privilege credentials: Acquire valid application credentials (e.g., via default credentials, credential stuffing, or a previously compromised account), as the vulnerability requires low-privilege authenticated access.
3. Identify the vulnerable endpoint: Locate the application interface or API endpoint that accepts and evaluates QLExpress expressions through the QLExpressEngine.doEval function, typically associated with job retry condition configuration or expression-based task logic.
4. Craft malicious QLExpress payload: Construct a QLExpress expression that executes arbitrary Java code or system commands, exploiting the lack of input sanitization in doEval (e.g., invoking Runtime.getRuntime().exec(...) or similar Java reflection techniques).
5. Submit the payload: Send the crafted expression to the vulnerable endpoint via an authenticated HTTP request.
6. Achieve code execution: The server evaluates the injected expression, resulting in unauthorized code execution within the application's runtime context, potentially enabling data exfiltration, configuration tampering, or further lateral movement.

• Logs: Unusual or unexpected QLExpress expressions submitted to job configuration or retry condition endpoints in application access logs; Java exceptions or stack traces related to QLExpressEngine.doEval in snail-job application logs.
• Process: Unexpected child processes spawned by the snail-job Java process (e.g., cmd.exe, /bin/sh, curl, wget) that are not part of normal job execution.
• Network: Outbound connections from the snail-job server to unknown external IP addresses or domains, particularly following authenticated API calls to expression evaluation endpoints.
• File System: Unexpected files written to the snail-job working directory or system temp directories by the application process, such as scripts, binaries, or web shells.

The vendor has released version 1.7.0-beta1 of snail-job, which addresses this vulnerability via patch commit 978f316c38b3d68bb74d2489b5e5f721f6675e86 (Gitee Release). All users running snail-job versions up to 1.6.0 should upgrade to 1.7.0-beta1 or later as the primary remediation. As interim mitigations, restrict access to the snail-job application to trusted users only, implement strict input validation and allowlisting for expression inputs, and audit usage of the QLExpressEngine.doEval function for any suspicious expressions (GitHub Advisory).