CVE-2025-7901
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the configUrl parameter in Swagger UI within RuoYi systems. When exploited, it enables cross-site scripting attacks that can steal session cookies, redirect users, or perform actions on their behalf. Organizations running RuoYi up to version 4.8.1 with Swagger UI exposed are affected.
💻 Affected Systems
- yangzongzhuan RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system access, and compromise sensitive data or deploy ransomware.
Likely Case
Attackers steal user session cookies to hijack accounts, perform unauthorized actions, or redirect to phishing sites.
If Mitigated
With proper input validation and output encoding, the attack fails, causing no impact beyond failed exploitation attempts.
🎯 Exploit Status
Exploitation requires the attacker to trick a user into visiting a malicious URL. No authentication is needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.2 or later
Vendor Advisory: https://github.com/yangzongzhuan/RuoYi/issues/293
Restart Required: Yes
Instructions:
1. Update RuoYi to version 4.8.2 or later. 2. Restart the application server. 3. Verify the fix by testing the configUrl parameter.
🔧 Temporary Workarounds
Disable Swagger UI
allRemove or restrict access to the Swagger UI endpoint to prevent exploitation.
# In application configuration, set swagger.enabled=false or remove /swagger-ui mapping
Input Validation Filter
allImplement a web application firewall or filter to sanitize configUrl parameter inputs.
# Configure WAF rules to block script tags and JavaScript in URL parameters
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline scripts and external resources.
- Use network segmentation to isolate RuoYi instances and restrict access to trusted users only.
🔍 How to Verify
Check if Vulnerable:
Access /swagger-ui/index.html?configUrl=javascript:alert('test') and check if script executes. Use browser developer tools to inspect for script injection.Check Version:
Check RuoYi version in application logs or configuration files; typically in application.yml or pom.xml for version 4.8.1 or earlier.Verify Fix Applied:
After patching, test the same payload; it should not execute and should be properly encoded or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /swagger-ui/index.html with long or encoded parameters containing script tags or JavaScript.
Network Indicators:
- HTTP requests with configUrl parameter containing javascript: or script payloads.
SIEM Query:
source="web_logs" AND uri="/swagger-ui/index.html" AND (param="configUrl" AND value MATCHES "javascript:*" OR "<script>*")