CVE-2025-46175

Executive Summary

CVE-2025-46175 is an Incorrect Access Control vulnerability in Ruoyi v4.8.0, specifically in the authRole method of SysUserController.java. The vulnerability arises from a missing checkUserDataScope permission check, allowing an authenticated attacker to assign roles to users outside their intended data scope. This can lead to privilege escalation and unauthorized access to sensitive administrative functions. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is significant due to the potential for lateral movement and privilege escalation within the Ruoyi management system.

Supply Chain & Package Security

Ruoyi is a Java-based open-source management system. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Ruoyi should verify the integrity of their deployment and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Changed (privilege escalation)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): Low

Threat Level: High. The vulnerability allows an authenticated user to assign roles to users outside their data scope, potentially granting administrative privileges.

Deep Dive & Mechanics

The vulnerability is located in the authRole method of SysUserController.java. This method is responsible for assigning roles to users. In Ruoyi v4.8.0, the method lacks a call to checkUserDataScope, which is a security check that ensures the current user has permission to modify the target user's roles based on data scope (e.g., department or organization). Without this check, an attacker with low-level access can assign high-privilege roles (like admin) to any user, including themselves, leading to full system compromise.

The missing check is a classic example of improper access control (CWE-284). The checkUserDataScope function typically verifies that the current user's data scope includes the target user's department or organization. Without it, the system trusts the user's input without validation.

Vulnerable vs. Patched Code

Vulnerable Code (v4.8.0):

// SysUserController.java
@PostMapping("/authRole")
public AjaxResult authRole(Long userId, Long[] roleIds) {
    // Missing checkUserDataScope(userId)
    sysUserService.insertUserAuth(userId, roleIds);
    return success();
}

Patched Code (Hypothetical):

// SysUserController.java
@PostMapping("/authRole")
public AjaxResult authRole(Long userId, Long[] roleIds) {
    checkUserDataScope(userId); // Added security check
    sysUserService.insertUserAuth(userId, roleIds);
    return success();
}

The patch adds a call to checkUserDataScope(userId) before performing the role assignment, ensuring the current user has permission to modify the target user's roles.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Ruoyi v4.8.0 instance with a valid low-privilege user account.
• Knowledge of the target user ID to assign roles to.

Exploitation Steps:

1. Authenticate to the Ruoyi application with a low-privilege user.
2. Identify a target user ID (e.g., an admin user or a user in a different department).
3. Send a POST request to /system/user/authRole with the target user ID and desired role IDs (e.g., admin role ID).
4. The system assigns the roles without checking data scope, granting the target user elevated privileges.

Example Request:

POST /system/user/authRole HTTP/1.1
Host: target-ruoyi.com
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=your_session_id

userId=1&roleIds=1

Note: The exact role IDs and user IDs can be enumerated through other endpoints.

Blue Team

Detection:

• Monitor for unusual POST requests to /system/user/authRole from low-privilege users.
• Alert on role assignments that cross department or organizational boundaries.
• Review logs for insertUserAuth calls without preceding checkUserDataScope checks.

Mitigation:

• Apply the patch by adding checkUserDataScope(userId) to the authRole method.
• Implement additional logging and monitoring for role assignment activities.
• Restrict access to the authRole endpoint to only authorized administrators.

Indicators of Compromise (IOCs)

• Network: POST requests to /system/user/authRole with parameters userId and roleIds.
• Logs: Entries showing insertUserAuth calls without corresponding checkUserDataScope checks.
• System: Unexpected role assignments, especially to users outside their department.
• User: Accounts with elevated privileges that were not authorized.

Detection Engineering

YARA Rule

rule CVE_2025_46175_Ruoyi_AuthRole_Missing_Check {
    meta:
        description = "Detects missing checkUserDataScope in authRole method of SysUserController.java"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46175"
    strings:
        $s1 = "authRole" ascii wide nocase
        $s2 = "insertUserAuth" ascii wide nocase
        $s3 = "checkUserDataScope" ascii wide nocase
    condition:
        $s1 and $s2 and not $s3
}

Sigma Rule

title: CVE-2025-46175 - Ruoyi Incorrect Access Control in authRole
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-46175 by monitoring for POST requests to /system/user/authRole
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/system/user/authRole'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46175 - Ruoyi authRole Exploitation Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/system/user/authRole"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Manually add the checkUserDataScope(userId) call to the authRole method in SysUserController.java and redeploy the application.
2. Short-term: Review all other controller methods for missing checkUserDataScope checks and apply similar fixes.
3. Long-term: Implement a centralized access control mechanism that enforces data scope checks at the framework level.
4. Monitoring: Enable detailed logging for all role assignment operations and set up alerts for suspicious activity.
5. User Training: Educate administrators about the importance of data scope checks and the risks of improper access control.

Valters IT
Securing Digital Frontiers