CVE-2025-6925

Executive Summary

CVE-2025-6925 is a critical path traversal vulnerability discovered in Dromara RuoYi-Vue-Plus version 5.4.0. The flaw resides in the MailController.java file, specifically within the /src/main/java/org/dromara/demo/controller/MailController.java endpoint. By manipulating the filePath argument, an unauthenticated remote attacker can traverse directories outside the intended root, leading to unauthorized read access to arbitrary files on the server. The vendor was contacted but did not respond, and a public proof-of-concept (PoC) exploit has been released, increasing the risk of active exploitation. This vulnerability is classified as critical due to its low attack complexity and potential for sensitive data disclosure.

Supply Chain & Package Security

This vulnerability affects a Java-based application (RuoYi-Vue-Plus), which is a popular rapid development framework. While not a direct package manager issue (like NPM or PyPI), the risk extends to the software supply chain if this framework is used as a dependency in other projects. Organizations using RuoYi-Vue-Plus should treat this as a critical supply chain risk and immediately assess their exposure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Complete file read access.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High) – Confidentiality impact is high, but integrity and availability are not affected.

Threat Level: Critical – Public PoC, no patch, and low attack complexity make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the MailController class. The filePath parameter is used to specify a file path for mail attachment operations. The application fails to sanitize or validate user-supplied input, allowing an attacker to inject sequences like ../ to escape the intended directory.

Technical Flow:

1. The MailController receives a request with a filePath parameter.
2. The application constructs a file path by concatenating a base directory with the user-supplied filePath.
3. Without proper validation, the attacker can supply ../../etc/passwd to read sensitive system files.
4. The file content is then returned in the response or used in an email attachment, leading to data disclosure.

Root Cause: Lack of input validation and absence of a canonical path check. The application should use Path.normalize() and verify that the resolved path starts with the allowed base directory.

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi-Vue-Plus 5.4.0):

// MailController.java
@PostMapping("/send")
public void sendMail(@RequestParam String filePath) {
    File file = new File("/app/uploads/" + filePath);
    // ... send email with attachment
}

Patched Code (Hypothetical Fix):

// MailController.java
@PostMapping("/send")
public void sendMail(@RequestParam String filePath) {
    Path basePath = Paths.get("/app/uploads/").normalize();
    Path resolvedPath = basePath.resolve(filePath).normalize();
    if (!resolvedPath.startsWith(basePath)) {
        throw new SecurityException("Invalid file path");
    }
    File file = resolvedPath.toFile();
    // ... send email with attachment
}

The patched version uses Path.normalize() to resolve any ../ sequences and then checks that the resulting path is still within the allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: RuoYi-Vue-Plus 5.4.0 running on a Java application server (e.g., Tomcat).
• Tooling: curl, Burp Suite, or custom Python script.

Exploit PoC:

curl -X POST "http://target.com/mail/send" \
  -d "filePath=../../../../etc/passwd"

Expected Response: The contents of /etc/passwd will be returned or attached to an email.

Advanced Exploitation:

• Read application configuration files (e.g., application.yml) to extract database credentials.
• Access SSH keys, TLS certificates, or other sensitive data.
• Chain with other vulnerabilities for lateral movement.

Blue Team (Defensive)

Detection:

• Monitor for requests containing ../ or ..\\ in the filePath parameter.
• Alert on unusual file read patterns (e.g., reading /etc/passwd, /proc/self/environ).

Hunting:

• Search logs for POST /mail/send with filePath containing directory traversal sequences.
• Check for outbound emails with unexpected attachments (e.g., system files).

Containment:

• Immediately block the vulnerable endpoint via WAF rules.
• Restrict file system access for the application user.
• Apply virtual patching if a WAF is available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /mail/send with filePath parameter containing ../ or ..\\.
  • Outbound SMTP traffic with unusual attachment names (e.g., passwd, shadow, config).

• File System IOCs:

  • Unexpected file reads from /etc/passwd, /etc/shadow, /proc/self/environ, or application config files.
  • Presence of temporary files created by the mail handler in unusual directories.

• Log IOCs:

  • Application logs showing FileNotFoundException for paths outside the uploads directory.
  • Web server logs with 400 or 500 errors on the /mail/send endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_6925_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests targeting RuoYi-Vue-Plus MailController"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6925"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/mail/send"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-6925 Path Traversal in RuoYi-Vue-Plus MailController
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in HTTP requests to the /mail/send endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/mail/send'
        cs-uri-query|contains|all:
            - 'filePath'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6925 Path Traversal in RuoYi-Vue-Plus MailController"; flow:to_server,established; content:"POST"; http_method; content:"/mail/send"; http_uri; content:"filePath"; http_client_body; pcre:"/filePath=[^&]*(\.\.\/|\.\.\\)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block /mail/send at the web server or application gateway.
2. Apply virtual patching using a WAF to block requests containing ../ or ..\\ in the filePath parameter.
3. Restrict file system permissions for the application user to prevent reading sensitive files.

Long-Term Fix:

• Upgrade to a patched version of RuoYi-Vue-Plus once available.
• Implement input validation using a whitelist approach (e.g., only allow alphanumeric filenames).
• Use Path.normalize() and startsWith() checks as shown in the patched code example.
• Conduct a security audit of all file handling endpoints.

Workaround:

• If the mail functionality is critical, modify the source code to sanitize the filePath parameter as described in the patched code section.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert