CVE-2021-28411
📋 TL;DR
This vulnerability in RuoYi's CookieRememberMeManager allows remote attackers to escalate privileges by exploiting improper deserialization of remembered user identities. Any system running the affected RuoYi version with the remember-me feature enabled is vulnerable to authentication bypass and privilege escalation attacks.
💻 Affected Systems
- lerry903 RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, allowing attackers to execute arbitrary code, access sensitive data, and modify system configurations.
Likely Case
Authentication bypass leading to unauthorized access to privileged functionality and data exposure.
If Mitigated
Limited impact with proper network segmentation and authentication controls in place.
🎯 Exploit Status
The vulnerability is in the getRememberedSerializedIdentity function which improperly handles serialized data, allowing privilege escalation through cookie manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.4.0
Vendor Advisory: https://github.com/lerry903/RuoYi/issues/20
Restart Required: Yes
Instructions:
1. Upgrade RuoYi to the latest version. 2. Verify the CookieRememberMeManager class has been updated. 3. Restart the application server.
🔧 Temporary Workarounds
Disable Remember-Me Feature
allTemporarily disable the remember-me authentication functionality to prevent exploitation.
Modify application configuration to set remember-me feature to false
🧯 If You Can't Patch
- Implement strict input validation for authentication cookies
- Deploy web application firewall rules to detect and block suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check if running RuoYi version 3.4.0 and examine if CookieRememberMeManager class contains the vulnerable getRememberedSerializedIdentity function.Check Version:
Check application configuration files or deployment manifests for RuoYi version information.Verify Fix Applied:
Verify the application version is updated beyond 3.4.0 and test authentication flows with remember-me functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Multiple failed login attempts followed by successful privileged access
- Suspicious cookie values in authentication logs
Network Indicators:
- Unusual authentication requests with manipulated cookies
- Requests to privileged endpoints from unexpected sources
SIEM Query:
source="web_app" AND (event_type="authentication" AND cookie_length>normal) OR (user_privilege_change AND source_ip=new)