CVE-2025-2742

Executive Summary

CVE-2025-2742 is a critical path traversal vulnerability discovered in zhijiantianya ruoyi-vue-pro version 2.4.1. The flaw resides in the /admin-api/mp/material/upload-permanent endpoint of the Material Upload Interface. By manipulating the File argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading arbitrary files on the server. The vendor was contacted but did not respond, leaving the vulnerability unpatched. A public proof-of-concept (PoC) exists, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (ruoyi-vue-pro) distributed via GitHub and potentially other channels. As the vendor has not responded, there is no official patch or advisory. Organizations using this software should treat it as a supply chain risk and consider immediate mitigation or replacement.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Adjusted Score: 7.5 (High) based on public PoC and unpatched status.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – vulnerable component only.
• Confidentiality (C): High – arbitrary file read possible.
• Integrity (I): None – no file modification.
• Availability (A): None – no denial of service.

Threat Level: High. The combination of remote exploitability, no authentication, public PoC, and no patch makes this a priority for immediate action.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the file upload functionality. The endpoint /admin-api/mp/material/upload-permanent accepts a File parameter that is used to construct the file path for permanent storage. The application fails to sanitize or validate the filename, allowing an attacker to include path traversal sequences (e.g., ../) to escape the intended upload directory.

Attack Flow:

1. Attacker sends a POST request to /admin-api/mp/material/upload-permanent with a multipart form containing a file.
2. The File parameter is set to a value like ../../etc/passwd.
3. The application concatenates this value with the base upload path without validation.
4. The file is written to (or read from) the traversed path, allowing the attacker to read sensitive files (e.g., /etc/passwd, application configs, database credentials).

Root Cause: Lack of input validation and insufficient path normalization in the file handling logic.

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-vue-pro 2.4.1):

// Example of vulnerable file upload handler
public String uploadPermanent(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // No sanitization of fileName
    String filePath = uploadDir + "/" + fileName;
    // Write file to filePath
    File dest = new File(filePath);
    file.transferTo(dest);
    return "success";
}

Patched Code (Hypothetical):

public String uploadPermanent(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Sanitize filename: remove path traversal sequences
    fileName = fileName.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    // Normalize path
    String filePath = uploadDir + "/" + fileName;
    // Ensure path is within uploadDir
    File dest = new File(filePath);
    if (!dest.getCanonicalPath().startsWith(new File(uploadDir).getCanonicalPath())) {
        throw new SecurityException("Invalid file path");
    }
    file.transferTo(dest);
    return "success";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ruoyi-vue-pro 2.4.1 with the vulnerable endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Identify the target endpoint: POST /admin-api/mp/material/upload-permanent
2. Craft a malicious multipart request with a path traversal payload in the File parameter.

Example cURL command:

curl -X POST http://target.com/admin-api/mp/material/upload-permanent \
  -F "file=@/etc/passwd" \
  -F "File=../../etc/passwd"

Expected Output: The contents of /etc/passwd will be returned in the response (if the application echoes the file content) or written to a traversed location.

Advanced Exploitation:

• Read application configuration files (e.g., application.yml) to extract database credentials.
• Chain with other vulnerabilities for RCE.

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /admin-api/mp/material/upload-permanent with suspicious File parameters containing ../ or ..\\.
• Alert on unusual file paths in upload logs.

Defense:

• Implement input validation: reject filenames containing ../, ..\\, or absolute paths.
• Use a whitelist of allowed characters for filenames.
• Store uploaded files in a database or use a secure file storage service (e.g., S3 with signed URLs).
• Apply strict filesystem permissions to prevent reading sensitive files.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin-api/mp/material/upload-permanent with File parameter containing ../ or ..\\.
• Unusual file paths in HTTP responses (e.g., /etc/passwd, /proc/self/environ).

File System IOCs:

• Unexpected files in the upload directory with names like ../../etc/passwd.
• Modified timestamps on sensitive system files.

Log IOCs:

• Application logs showing file paths with ../ sequences.
• Web server logs with 200 responses to the vulnerable endpoint and large response sizes (indicating file read).

Detection Engineering

YARA Rule

rule CVE_2025_2742_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in ruoyi-vue-pro upload endpoint"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-2742"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/admin-api/mp/material/upload-permanent"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-2742 Path Traversal in ruoyi-vue-pro
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts targeting the material upload endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin-api/mp/material/upload-permanent'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2742 Path Traversal in ruoyi-vue-pro"; flow:to_server,established; content:"POST"; http_method; content:"/admin-api/mp/material/upload-permanent"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block /admin-api/mp/material/upload-permanent at the web server or WAF level.
2. Apply input validation via a reverse proxy or WAF: Reject requests containing ../ or ..\\ in the File parameter.
3. Restrict file permissions on the server to prevent reading sensitive files even if traversal occurs.

Long-term Fix:

• Upgrade to a patched version of ruoyi-vue-pro once available.
• Implement secure file upload practices:
  • Use a random filename for storage.
  • Store files outside the web root.
  • Validate file content type and size.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If the application is critical, consider deploying a virtual patch via a WAF (e.g., ModSecurity rule to block path traversal patterns).

Valters IT
DevSecOps & Cyber Threat Intelligence