CVE-2025-2743

Executive Summary

CVE-2025-2743 is a path traversal vulnerability in the zhijiantianya ruoyi-vue-pro application, version 2.4.1. The flaw resides in the Material Upload Interface, specifically within the /admin-api/mp/material/upload-temporary endpoint. By manipulating the File argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading arbitrary files from the server. The vendor was contacted but did not respond, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (ruoyi-vue-pro). While not a direct package manager issue (NPM, PyPI, Go, Ruby), the application may depend on third-party libraries. The path traversal occurs in custom application code, not in a dependency. However, users should review their dependency tree for any related file handling libraries that might be misconfigured.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file read
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows read access to files on the server, but not write or execute. However, combined with other flaws, it could lead to information disclosure (e.g., configuration files, credentials).

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the file upload functionality. The endpoint /admin-api/mp/material/upload-temporary accepts a File parameter. The application fails to sanitize or validate the file path, allowing an attacker to include ../ sequences to escape the intended upload directory.

Root Cause: The application likely concatenates the user-supplied filename with a base directory without checking for path traversal sequences. For example:

String uploadDir = "/var/uploads/";
String filePath = uploadDir + fileName; // fileName = "../../etc/passwd"

Attack Flow:

1. Attacker sends a POST request to /admin-api/mp/material/upload-temporary with a File parameter containing path traversal sequences.
2. The server processes the request and writes the file to the traversed path, or in this case, reads the file content and returns it.
3. The attacker receives the contents of arbitrary files (e.g., /etc/passwd, application configs).

Impact: Unauthorized read access to sensitive files, including database credentials, API keys, source code, and system configuration.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@PostMapping("/upload-temporary")
public String uploadTemporary(@RequestParam("File") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String uploadDir = "/var/uploads/";
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
    return "Uploaded";
}

Patched Code (Conceptual):

@PostMapping("/upload-temporary")
public String uploadTemporary(@RequestParam("File") MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Sanitize filename: remove path traversal sequences
    fileName = new File(fileName).getName(); // strips directory components
    String uploadDir = "/var/uploads/";
    File dest = new File(uploadDir + fileName);
    // Ensure the file is within the upload directory
    if (!dest.getCanonicalPath().startsWith(new File(uploadDir).getCanonicalPath())) {
        throw new SecurityException("Invalid file path");
    }
    file.transferTo(dest);
    return "Uploaded";
}

Key Differences:

• The patched version uses File.getName() to strip directory components.
• It also validates the canonical path to ensure the destination is within the intended directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ruoyi-vue-pro 2.4.1
• Network access to the /admin-api/mp/material/upload-temporary endpoint

Exploit Steps:

1. Identify the target endpoint.
2. Craft a POST request with a malicious File parameter.

Example using cURL:

curl -X POST \
  -F "File=@/etc/passwd;filename=../../etc/passwd" \
  http://target.com/admin-api/mp/material/upload-temporary

Expected Output: The server may return the contents of /etc/passwd or an error if the file is not readable. If the endpoint returns a success message, the file may have been written to the traversed path.

Advanced Exploitation:

• Read application configuration files (e.g., application.yml, application.properties) to extract database credentials.
• Read source code to find additional vulnerabilities.
• Combine with other attacks (e.g., SSRF) for lateral movement.

Blue Team (Defensive)

Detection:

• Monitor for requests to /admin-api/mp/material/upload-temporary with filenames containing ../ or ..\\.
• Look for unusual file paths in upload logs.
• Use WAF rules to block path traversal patterns.

Hunting:

• Search for files written outside the intended upload directory.
• Check for unexpected file reads in application logs.

Lab Setup:

1. Deploy ruoyi-vue-pro 2.4.1 in a sandboxed environment.
2. Enable detailed logging for the upload endpoint.
3. Simulate the attack and observe logs.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin-api/mp/material/upload-temporary with File parameter containing ../ or ..\\.
  • Outbound connections from the server to unknown IPs (if exfiltration occurs).
• File System:
  • Files created outside the intended upload directory (e.g., /etc/, /var/www/).
  • Unexpected file reads (e.g., /etc/passwd, /proc/self/environ).
• Logs:
  • Application logs showing file paths with ../ sequences.
  • Web server logs (e.g., Apache, Nginx) showing unusual POST requests.

Detection Engineering

YARA Rule

rule CVE_2025_2743_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in ruoyi-vue-pro upload endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2743"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/admin-api/mp/material/upload-temporary"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-2743 Path Traversal in ruoyi-vue-pro
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts targeting the material upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin-api/mp/material/upload-temporary'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2743 Path Traversal in ruoyi-vue-pro"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin-api/mp/material/upload-temporary"; http.client_body; content:"../"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /admin-api/mp/material/upload-temporary via WAF or reverse proxy.
2. Apply input validation: Sanitize filenames to remove path traversal sequences (e.g., ../, ..\\).
3. Use a whitelist of allowed file extensions and names.

Long-term Fix:

• Upgrade to a patched version of ruoyi-vue-pro when available.
• Implement proper file path validation using canonical path checks.
• Use a secure file upload library that handles path traversal.

Workaround:

• Restrict the upload directory permissions to prevent reading sensitive files.
• Monitor logs for suspicious activity.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.