CVE-2025-28412
📋 TL;DR
A privilege escalation vulnerability in RUoYi v.4.8.0 allows remote attackers to gain elevated privileges through the /editSave method in SysNoticeController. This affects all systems running the vulnerable version of RUoYi, potentially enabling unauthorized administrative access.
💻 Affected Systems
- RUoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, allowing data theft, system modification, and further attack propagation.
Likely Case
Unauthorized privilege escalation leading to administrative access, data manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper access controls and network segmentation, potentially preventing successful exploitation.
🎯 Exploit Status
Exploitation requires some level of access but is straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v.4.8.1 or later
Vendor Advisory: https://github.com/yangzongzhuan/RuoYi
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Update to RUoYi v.4.8.1 or later from the official repository. 3. Restart the application server. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Access Control Restriction
linuxRestrict access to the /editSave endpoint using web application firewall or network controls.
iptables -A INPUT -p tcp --dport 8080 -m string --string "/editSave" --algo bm -j DROP
Endpoint Disablement
allTemporarily disable or modify the SysNoticeController to prevent exploitation.
# Modify application configuration to restrict /editSave endpoint access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RUoYi instances
- Enforce principle of least privilege and monitor for unusual privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if RUoYi version is 4.8.0 by examining application version files or configuration.Check Version:
grep -r "version" /path/to/ruoyi/config/ || check application metadataVerify Fix Applied:
Verify the application version is updated to 4.8.1 or later and test the /editSave endpoint for proper access controls.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /editSave endpoint
- Multiple failed privilege escalation attempts
- Successful administrative access from non-admin accounts
Network Indicators:
- HTTP POST requests to /editSave with privilege modification parameters
- Unusual traffic spikes to the SysNoticeController
SIEM Query:
source="web_logs" AND uri_path="/editSave" AND (http_method="POST" OR status_code=200)