CVE-2025-63690: 
NixOS vulnerability analysis and mitigation

CVE-2025-63690 is a remote code execution (RCE) vulnerability in pig-mesh Pig (pig4cloud/pig), a Java-based microservices framework. Affecting versions 3.8.2 and below, the flaw resides in the Quartz job scheduling management function within the system management module, where unsafe reflection allows authenticated high-privilege attackers to execute arbitrary Java code. It was published on November 7, 2025, with a CVSS v3.1 base score of 9.1 (Critical) (Feedly, PoC Write-up).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — 'Unsafe Reflection'). When creating a scheduled task in the Quartz management interface, the application allows an attacker to specify an arbitrary Java class name and method, which are then instantiated and invoked via reflection without adequate validation. Specifically, an attacker can target Tomcat's built-in jakarta.el.ELProcessor class and invoke its eval() method with a crafted Expression Language (EL) payload to achieve arbitrary OS command execution. The vulnerability was demonstrated using JDK 17.0.12 and Tomcat 10.1.31 in a microservices deployment, and a public PoC write-up with reproduction steps is available (PoC Write-up, Feedly).

Successful exploitation grants an authenticated high-privilege attacker full remote code execution on the affected server, with high impact to confidentiality, integrity, and availability. The attacker can execute arbitrary system commands, exfiltrate sensitive data, compromise the entire application, and potentially pivot to other services within the microservices environment. The CVSS scope is marked as 'Changed,' indicating that the impact can extend beyond the vulnerable component itself (Feedly).

A public proof-of-concept (PoC) write-up is available on GitHub, demonstrating the full exploitation chain including DNSLog-based command execution confirmation (PoC Write-up). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.498%, reflecting a currently low but non-negligible probability of exploitation. Exploitation requires authentication with high-privilege credentials, which limits the attack surface but does not eliminate risk in environments with weak access controls (Feedly).

1. Reconnaissance: Identify a pig-mesh Pig deployment running version 3.8.2 or below. Confirm access to the administrative web interface and obtain or compromise a high-privilege account.
2. Authenticate: Log in to the Pig system management portal using high-privilege credentials.
3. Navigate to Quartz Management: Go to the System Management module and open the Quartz (scheduled task) management function.
4. Create a malicious scheduled task: Add a new scheduled task, setting the job class to jakarta.el.ELProcessor (a Tomcat built-in class with a parameterless constructor) and the method to eval, with a crafted EL expression as the String parameter — e.g., an expression that executes an OS command such as a DNS lookup to a controlled DNSLog domain.
5. Start the task: Activate the newly created malicious scheduled task.
6. Trigger immediate execution: Use the 'Execute Now' option to run the malicious task immediately.
7. Confirm execution: Verify successful command execution by observing the DNS query on the attacker-controlled DNSLog platform, confirming arbitrary code execution on the server (PoC Write-up).

• Logs: Application or audit logs showing creation of new Quartz scheduled tasks by administrative users, especially with class names referencing jakarta.el.ELProcessor or other unusual Java classes; logs showing immediate/manual execution of newly created tasks.
• Network: Unexpected outbound DNS queries from the application server to external or unknown domains (indicative of DNSLog-based PoC or exfiltration); unusual outbound connections (reverse shells, HTTP callbacks) originating from the Pig application process.
• Process: Unexpected child processes spawned by the Java/Tomcat process (e.g., sh, bash, cmd.exe, curl, wget, nslookup) following Quartz task execution.
• File System: New or modified files in the application directory created by the Tomcat/Java process, such as web shells or dropped binaries, following scheduled task execution.

The recommended remediation is to upgrade pig-mesh Pig to a version later than 3.8.2, which addresses the unsafe reflection issue in the Quartz management function (Feedly). As interim mitigations, administrators should restrict access to the system management and Quartz scheduling interfaces to trusted networks and users only, enforce strong authentication and the principle of least privilege for administrative accounts, and monitor and audit all administrative actions. If the Quartz scheduling feature is not required, consider disabling it entirely until a patch can be applied.

The vulnerability was reported via a GitHub issue on the pig-mesh/pig repository (since deleted) and documented in a public PoC write-up by researcher LockeTom (PoC Write-up). Red Hat tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.