CVE-2025-2742
📋 TL;DR
This critical vulnerability in ruoyi-vue-pro 2.4.1 allows remote attackers to perform path traversal attacks through the material upload interface. By manipulating file upload parameters, attackers can potentially delete arbitrary files on the server. All systems running the vulnerable version with the material upload interface exposed are affected.
💻 Affected Systems
- zhijiantianya ruoyi-vue-pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or privilege escalation.
Likely Case
Unauthorized deletion of application files, configuration files, or user-uploaded content, causing service disruption and potential data loss.
If Mitigated
Limited impact with proper file permission restrictions and input validation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation on the upload-permanent material endpoint to reject any file paths containing directory traversal sequences.
Access Control Restriction
allRestrict access to the /admin-api/mp/material/upload-permanent endpoint to authorized users only and implement rate limiting.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns in requests to the vulnerable endpoint.
- Monitor and audit file deletion activities on the server and set up alerts for suspicious patterns.
🔍 How to Verify
Check if Vulnerable:
Check if running ruoyi-vue-pro version 2.4.1 and if the /admin-api/mp/material/upload-permanent endpoint is accessible. Test with controlled path traversal payloads.Check Version:
Check application configuration files or deployment manifests for version information.Verify Fix Applied:
Verify that path traversal attempts are blocked and that file operations are restricted to intended directories.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in application logs
- Failed or successful path traversal attempts in access logs
Network Indicators:
- HTTP requests to /admin-api/mp/material/upload-permanent with suspicious file parameters containing ../ sequences
SIEM Query:
source="application_logs" AND (event="file_deletion" OR message="../")🔗 References
- https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial
- https://vuldb.com/?ctiid.300844
- https://vuldb.com/?id.300844
- https://vuldb.com/?submit.519691
- https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial
