CVE-2025-46174
📋 TL;DR
Ruoyi v4.8.0 has an incorrect access control vulnerability in the resetPwd method that allows unauthorized password resets. Attackers can reset passwords of any user account without proper permission checks. This affects all deployments using the vulnerable version of Ruoyi.
💻 Affected Systems
- Ruoyi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user including administrators, leading to full system compromise and data breach.
Likely Case
Unauthorized password reset of regular user accounts enabling privilege escalation or lateral movement.
If Mitigated
Limited impact with proper network segmentation and monitoring detecting unauthorized password reset attempts.
🎯 Exploit Status
Exploit requires authenticated access but bypasses permission checks; public proof-of-concept available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit ea4af7a8cf54393b11d3d286e0aaeb3df8a9aaef
Vendor Advisory: https://gitee.com/y_project/RuoYi/issues/IC1JZR
Restart Required: Yes
Instructions:
1. Update to latest Ruoyi version or apply commit ea4af7a8cf54393b11d3d286e0aaeb3df8a9aaef. 2. Rebuild and redeploy the application. 3. Restart application server.
🔧 Temporary Workarounds
Temporary access control hardening
allManually add permission checks to resetPwd method in SysUserController.java
Edit SysUserController.java to add @RequiresPermissions("system:user:resetPwd") annotation before resetPwd method
🧯 If You Can't Patch
- Implement network-level access controls to restrict who can access the user management endpoints.
- Enable detailed logging and monitoring for password reset attempts and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check if SysUserController.java resetPwd method lacks @RequiresPermissions annotation in Ruoyi v4.8.0.Check Version:
Check application version in Ruoyi admin interface or project configuration files.Verify Fix Applied:
Verify @RequiresPermissions("system:user:resetPwd") annotation exists before resetPwd method in patched version.📡 Detection & Monitoring
Log Indicators:
- Multiple password reset requests from single user
- Password reset requests for accounts not owned by requester
Network Indicators:
- POST requests to /system/user/resetPwd endpoint with different user IDs
SIEM Query:
source="web_logs" AND uri="/system/user/resetPwd" AND status=200 | stats count by src_ip, user_id