CVE-2025-2707

Executive Summary

CVE-2025-2707 is a critical path traversal vulnerability discovered in the zhijiantianya ruoyi-vue-pro application, version 2.4.1. The flaw resides in the /app-api/infra/file/upload endpoint of the Front-End Store Interface. By manipulating the path argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially leading to arbitrary file read, write, or overwrite. This can result in full server compromise, data exfiltration, or code execution. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, and the vendor has not responded to disclosure attempts, leaving the software unpatched. The EPSS score is currently 0.0%, indicating low exploitation activity, but the public availability of exploit details increases the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in a Java-based web application (ruoyi-vue-pro). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file system read access.
• Integrity Impact: High (I:H) – Ability to write/overwrite files.
• Availability Impact: High (A:H) – Potential to overwrite critical system files.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a severe risk for any exposed instance.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the file upload functionality of ruoyi-vue-pro. The application fails to properly sanitize the path parameter in the /app-api/infra/file/upload endpoint. An attacker can inject sequences like ../ to navigate to parent directories.

Mechanism:

1. The application receives a multipart file upload request to /app-api/infra/file/upload.
2. The path parameter is intended to specify a subdirectory within the upload root (e.g., /uploads/images/).
3. Due to insufficient validation, the application concatenates the user-supplied path with the base upload directory without checking for traversal sequences.
4. An attacker can set path to something like ../../etc/ to write a file to /etc/ on the server.
5. If the uploaded file is a JSP or other executable type, the attacker can achieve remote code execution.

Root Cause: Lack of input validation and canonical path checking. The application should resolve the final path and ensure it stays within the intended upload directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation without validation
String basePath = "/var/www/uploads/";
String userPath = request.getParameter("path"); // e.g., "../../etc/"
String fullPath = basePath + userPath + "/" + fileName;
File uploadedFile = new File(fullPath);
// Save file...

Patched Code (Conceptual):

// Patched: Validate and canonicalize the path
String basePath = "/var/www/uploads/";
String userPath = request.getParameter("path");
File baseDir = new File(basePath).getCanonicalFile();
File targetDir = new File(baseDir, userPath).getCanonicalFile();
if (!targetDir.getPath().startsWith(baseDir.getPath())) {
    throw new SecurityException("Invalid path");
}
String fullPath = targetDir.getPath() + "/" + fileName;
File uploadedFile = new File(fullPath);
// Save file...

Note: Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ruoyi-vue-pro 2.4.1 with the upload endpoint exposed.
• No authentication required.

Exploit Steps:

1. Craft a malicious file (e.g., a JSP webshell) to upload.
2. Use a tool like curl to send the request with a path traversal payload.

Example curl command:

curl -X POST \
  -F "file=@webshell.jsp" \
  -F "path=../../../../opt/tomcat/webapps/ROOT/" \
  http://target.com/app-api/infra/file/upload

Expected Result: The file webshell.jsp is written to the Tomcat web root, accessible via http://target.com/webshell.jsp.

Alternative Payloads:

• Overwrite configuration files (e.g., application.yml) to disable security.
• Upload a cron job script to /etc/cron.d/ for persistence.

Blue Team (Defense & Detection)

Detection:

• Monitor for file upload requests with suspicious path parameters containing ../ or ..\.
• Alert on uploads to unexpected directories (e.g., /etc/, /bin/, /opt/).
• Use Web Application Firewall (WAF) rules to block path traversal patterns.

Hunting:

• Search logs for POST /app-api/infra/file/upload with path containing ...
• Check for recently created files in sensitive directories (e.g., /etc/, /usr/share/).

Lab Setup:

• Deploy ruoyi-vue-pro 2.4.1 in a sandboxed environment (Docker recommended).
• Expose the upload endpoint and test with the provided curl command.
• Monitor logs and file system changes.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /app-api/infra/file/upload with path parameter containing ../.
  • Outbound connections from the server to unknown IPs (if webshell is used).
• File System:
  • Unexpected files in /etc/, /opt/, /var/www/, or Tomcat web directories.
  • Files with suspicious extensions (.jsp, .php, .py, .sh) in non-standard locations.
• Logs:
  • Application logs showing file writes outside the intended upload directory.
  • System logs (e.g., audit.log) showing file creation in sensitive paths.

Detection Engineering

YARA Rule

rule CVE_2025_2707_Path_Traversal_Upload {
    meta:
        description = "Detects path traversal attempts in ruoyi-vue-pro file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2707"
    strings:
        $path_traversal = /path=[^&]*\.\.\// nocase
        $upload_endpoint = "/app-api/infra/file/upload"
    condition:
        $upload_endpoint and $path_traversal
}

Sigma Rule

title: CVE-2025-2707 Path Traversal in ruoyi-vue-pro File Upload
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with path traversal patterns in the file upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/app-api/infra/file/upload'
        cs-uri-query|contains: 'path='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in path (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2707 Path Traversal in ruoyi-vue-pro File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/app-api/infra/file/upload"; http_uri; content:"path="; http_uri; content:".."; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload endpoint if not required: Block /app-api/infra/file/upload at the WAF or reverse proxy.
2. Apply virtual patching: Use WAF rules to block requests containing ../ in the path parameter.
3. Restrict file permissions: Ensure the web application runs with minimal privileges (e.g., not as root).

Long-term Fix:

• Input validation: Implement strict validation of the path parameter. Reject any input containing .. or /.
• Canonical path check: Resolve the final path and verify it starts with the intended base directory.
• Upgrade: Monitor for an official patch from zhijiantianya. If none is released, consider migrating to an alternative solution.

Workaround:

• Modify the application code to use a whitelist of allowed subdirectories for uploads.

Valters IT
DevSecOps & Cyber Threat Intelligence Division