CVE-2025-66735

Executive Summary

CVE-2025-66735 is an Incorrect Access Control vulnerability in Youlai-boot version 2.21.1. The flaw resides in the getRoleForm function within SysRoleController.java, which fails to enforce proper permission checks. This allows any authenticated non-root user to directly access and retrieve root role data, leading to unauthorized disclosure of sensitive role configurations. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the potential for privilege escalation and information leakage.

Supply Chain & Package Security

This vulnerability affects the Youlai-boot Java application, which is not distributed via NPM, PyPI, Go, or Ruby registries. It is typically deployed as a standalone Spring Boot application. No supply chain package security implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid non-root account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Root role data exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (6.5) – Exploitation requires authentication but yields high-value data.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks in a Spring Boot controller. The SysRoleController class exposes a REST endpoint that calls getRoleForm. This method retrieves role details, including root roles, without verifying whether the requesting user has the necessary permissions (e.g., ROLE_ADMIN or ROLE_ROOT). In a properly secured system, the controller should check the user's granted authorities before returning sensitive data.

The root cause is the absence of Spring Security annotations like @PreAuthorize or manual permission checks in the method. This allows any authenticated user to invoke the endpoint and obtain root role information, which could be used to map out the role hierarchy and potentially escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (SysRoleController.java):

@GetMapping("/roleForm")
public Result getRoleForm(@RequestParam Long roleId) {
    SysRole role = sysRoleService.getById(roleId);
    return Result.success(role);
}

Patched Code (Hypothetical):

@GetMapping("/roleForm")
@PreAuthorize("hasRole('ADMIN')")
public Result getRoleForm(@RequestParam Long roleId) {
    SysRole role = sysRoleService.getById(roleId);
    return Result.success(role);
}

The patch adds a @PreAuthorize annotation to restrict access to users with the ADMIN role. Alternatively, a manual check using SecurityContextHolder could be implemented.

Exploitation & Lab Setup

Red Team

Prerequisites: A valid non-root user account on the Youlai-boot application.

Exploit Steps:

1. Authenticate to the application and obtain a session token.
2. Send a GET request to the vulnerable endpoint with a root role ID (e.g., 1).
3. Parse the response to extract root role details.

Example Request:

curl -X GET "http://target/api/sysRole/roleForm?roleId=1" \
  -H "Authorization: Bearer <token>"

Expected Response:

{
  "code": 200,
  "data": {
    "roleId": 1,
    "roleName": "ROOT",
    "permissions": ["*:*:*"]
  }
}

Blue Team

Detection: Monitor for unusual access to /api/sysRole/roleForm from non-admin users. Correlate with authentication logs to identify privilege escalation attempts.

Hunting: Search for requests to roleForm with roleId parameters that are not associated with the user's own roles.

Mitigation: Apply the patch by adding authorization checks. If patching is not possible, restrict network access to the endpoint or implement a WAF rule to block non-admin users.

Indicators of Compromise (IOCs)

• URL Pattern: /api/sysRole/roleForm?roleId=<number>
• HTTP Method: GET
• Response Body: Contains roleName and permissions fields for root roles.
• User Agent: Any standard browser or curl.
• Source IP: Any authenticated user's IP.

Detection Engineering

YARA Rule

rule CVE_2025_66735_Youlai_Role_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66735"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66735"
    strings:
        $url = "/api/sysRole/roleForm" ascii wide nocase
        $param = "roleId=" ascii wide nocase
    condition:
        any of ($url*) and any of ($param*)
}

Sigma Rule

title: CVE-2025-66735 Youlai-boot Role Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to root role data
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/sysRole/roleForm'
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-66735 Youlai-boot Role Access Attempt";
    flow:to_server;
    content:"GET";
    http_method;
    content:"/api/sysRole/roleForm";
    http_uri;
    content:"roleId=";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Restrict access to the /api/sysRole/roleForm endpoint using a Web Application Firewall (WAF) or reverse proxy to allow only admin IPs.
2. Short-term: Apply the patch by adding @PreAuthorize("hasRole('ADMIN')") to the getRoleForm method.
3. Long-term: Conduct a full security audit of all controller methods to ensure proper authorization checks are in place.
4. Monitoring: Enable detailed logging for all role-related API calls and alert on anomalies.

Valters IT
Securing Your Digital Frontier