CVE-2025-28403

Executive Summary

CVE-2025-28403 is a privilege escalation vulnerability in RuoYi v4.8.0, a popular open-source Java-based enterprise management framework. The flaw resides in the editSave method, which fails to properly validate whether the requesting user possesses administrative privileges before allowing modifications to system configuration settings. This allows a remote attacker with a low-privileged account to escalate their privileges to administrator level, potentially leading to full system compromise, data exfiltration, and lateral movement within the network.

The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation activity at the time of analysis. However, the lack of a patch and the public disclosure of the issue make it a significant risk for organizations using RuoYi v4.8.0.

Supply Chain & Package Security

RuoYi is a Java-based framework distributed via Maven Central and GitHub. The vulnerable component is part of the core ruoyi-admin module. Organizations should verify their dependency tree for ruoyi-admin version 4.8.0 and consider immediate mitigation measures.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability description and common characteristics of privilege escalation flaws, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full access to sensitive data.
• Integrity (I): High (H) – Full control over system configurations.
• Availability (A): High (H) – Potential to disrupt services.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Threat Level: High. The combination of low privileges required, network exploitability, and high impact makes this a critical risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is located in the editSave method of RuoYi's system configuration controller. This method is intended to allow administrators to modify system settings. However, the code fails to perform an authorization check to verify that the requesting user has the admin role or equivalent privileges.

Root Cause: Missing or insufficient access control annotation (e.g., @PreAuthorize or custom permission check) on the editSave endpoint.

Attack Flow:

1. An attacker authenticates as a low-privileged user (e.g., a regular employee account).
2. The attacker sends a crafted HTTP POST request to the /system/config/editSave endpoint with malicious payload to modify critical system settings (e.g., disabling security filters, changing admin credentials, or enabling debug modes).
3. The server processes the request without verifying the user's role, applying the changes.
4. The attacker can then leverage the modified settings to gain full administrative access.

Impact:

• Full administrative control over the RuoYi application.
• Access to all user data, including passwords and sensitive business information.
• Ability to modify system configurations, potentially leading to persistent backdoors.
• Potential for lateral movement to connected systems.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common secure coding practices.

Vulnerable Code (RuoYi v4.8.0):

@PostMapping("/editSave")
@ResponseBody
public AjaxResult editSave(SysConfig config) {
    // Missing authorization check
    return configService.updateConfig(config);
}

Patched Code (Hypothetical):

@PostMapping("/editSave")
@PreAuthorize("@ss.hasPermi('system:config:edit')")
@ResponseBody
public AjaxResult editSave(SysConfig config) {
    return configService.updateConfig(config);
}

The patched version adds a @PreAuthorize annotation that checks for the specific permission system:config:edit, which is typically only granted to administrators.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of RuoYi v4.8.0.
• A valid low-privileged user account (e.g., user1 with password password123).

Exploitation Steps:

1. Authenticate and obtain session cookie:

   curl -X POST http://target.com/login \
     -d "username=user1&password=password123" \
     -c cookies.txt
   

2. Craft a malicious request to modify system configuration:

   curl -X POST http://target.com/system/config/editSave \
     -b cookies.txt \
     -d "configId=1&configKey=sys.account.registerUser&configValue=false&configType=Y&remark=Disable registration"
   

3. Verify privilege escalation:

   • Attempt to access admin-only endpoints (e.g., user management).
   • If successful, the attacker now has administrative privileges.

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection and Response:

1. Monitor for unauthorized access to /system/config/editSave:

   • Alert on any request to this endpoint from non-admin users.
   • Correlate with user role information from authentication logs.

2. Review system configuration changes:

   • Enable audit logging for all configuration modifications.
   • Set up alerts for changes to critical settings (e.g., sys.account.registerUser, sys.user.initPassword).

3. Implement network segmentation:

   • Restrict access to the RuoYi admin interface to trusted IP ranges.

4. Apply virtual patching:

   • Use a Web Application Firewall (WAF) to block requests to /system/config/editSave from non-admin users.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /system/config/editSave with unusual parameters.
• Repeated failed login attempts followed by configuration changes.

Host IOCs:

• Unexpected changes to system configuration files in the database (e.g., sys_config table).
• New user accounts with administrative privileges.
• Modified log files indicating tampering.

Log IOCs:

• Log entries showing editSave method calls from non-admin users.
• Absence of @PreAuthorize or permission check logs for configuration changes.

Detection Engineering

YARA Rule

rule Detect_RuoYi_PrivEsc_CVE_2025_28403 {
    meta:
        description = "Detects RuoYi v4.8.0 privilege escalation attempt via editSave"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28403"
    strings:
        $s1 = "/system/config/editSave" ascii wide nocase
        $s2 = "editSave" ascii wide nocase
        $s3 = "SysConfig" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: RuoYi Privilege Escalation via editSave
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-28403 by accessing the editSave endpoint without proper privileges
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/system/config/editSave'
    condition: selection
falsepositives:
    - Legitimate admin activity
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-28403 - RuoYi Privilege Escalation via editSave";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/system/config/editSave"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, block access to /system/config/editSave for all non-admin users via web server configuration or WAF rules.
2. Implement manual authorization checks: Add a servlet filter or interceptor to verify user roles before processing the editSave request.
3. Upgrade to a patched version: Monitor the RuoYi project for an official patch and apply it as soon as available.

Long-term Recommendations:

1. Adopt secure coding practices: Ensure all sensitive endpoints have proper authorization checks using annotations like @PreAuthorize.
2. Conduct regular security audits: Perform code reviews and penetration testing on critical modules.
3. Implement role-based access control (RBAC): Enforce strict separation of privileges and regularly audit user roles.
4. Enable comprehensive logging: Log all configuration changes and access to sensitive endpoints for forensic analysis.

Valters IT