CVE-2023-49371
📋 TL;DR
RuoYi versions up to 4.6 contain a SQL injection vulnerability in the /system/dept/edit endpoint that allows attackers to execute arbitrary SQL commands. This affects all deployments of RuoYi up to version 4.6 that have this endpoint accessible. Attackers can potentially read, modify, or delete database contents.
💻 Affected Systems
- RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation in the RuoYi application database.
If Mitigated
Limited impact with proper input validation, WAF protection, and database permissions in place.
🎯 Exploit Status
Exploitation requires authentication to access the /system/dept/edit endpoint. Public proof-of-concept demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.7 or later
Vendor Advisory: https://github.com/ruoyi-vue/RuoYi
Restart Required: Yes
Instructions:
1. Upgrade RuoYi to version 4.7 or later. 2. Replace vulnerable files with patched versions. 3. Restart the application server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation and parameterized queries for the /system/dept/edit endpoint
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Restrict network access to the RuoYi application to trusted users only
- Implement database-level controls with minimal necessary permissions for application accounts
🔍 How to Verify
Check if Vulnerable:
Check RuoYi version in application interface or configuration files. If version is 4.6 or earlier, assume vulnerable.Check Version:
Check ruoyi-admin/src/main/resources/application.yml or application interface for version informationVerify Fix Applied:
Verify RuoYi version is 4.7 or later and test the /system/dept/edit endpoint with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by /system/dept/edit access
- SQL syntax errors in application logs
Network Indicators:
- HTTP POST requests to /system/dept/edit with SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/system/dept/edit" AND (param="' OR '1'='1" OR param LIKE "%SELECT%" OR param LIKE "%UNION%")