CVE-2025-66735
📋 TL;DR
CVE-2025-66735 is an access control vulnerability in youlai-boot V2.21.1 where the getRoleForm function lacks proper permission checks. This allows non-root users to access root role information, potentially enabling privilege escalation. Organizations using youlai-boot V2.21.1 are affected.
💻 Affected Systems
- youlai-boot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain administrative privileges, modify system configurations, access sensitive data, or deploy backdoors.
Likely Case
Unauthorized users access administrative role information, potentially enabling further privilege escalation attacks.
If Mitigated
With proper network segmentation and least privilege principles, impact is limited to the affected application instance.
🎯 Exploit Status
Exploitation requires authenticated access but minimal technical skill. Public references demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 9197065102f92264ded814a9d3e9f2a4ff0da121
Vendor Advisory: https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FR
Restart Required: Yes
Instructions:
1. Update youlai-boot to the patched version. 2. Apply commit 9197065102f92264ded814a9d3e9f2a4ff0da121. 3. Restart the application server.
🔧 Temporary Workarounds
Add permission check middleware
allImplement custom permission validation before the getRoleForm function executes.
Modify SysRoleController.java to add @PreAuthorize("hasRole('ROLE_ADMIN')") annotation
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable application from critical systems.
- Enforce strict access controls and monitor for unusual role access patterns.
🔍 How to Verify
Check if Vulnerable:
Check if youlai-boot version is V2.21.1 and review SysRoleController.java for missing permission checks in getRoleForm.Check Version:
Check application configuration files or use 'java -jar youlai-boot.jar --version' if available.Verify Fix Applied:
Verify the application uses the patched commit and test that non-admin users cannot access root role information.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /sys/role endpoints
- GET requests to role management endpoints from non-admin users
Network Indicators:
- HTTP requests to /sys/role/* from unauthorized IPs
SIEM Query:
source="application.log" AND (uri="/sys/role" OR uri="/sys/role/*") AND user_role!="admin"