CVE-2025-7907
📋 TL;DR
This vulnerability in RuoYi up to version 4.8.1 involves the use of default credentials in the Druid component configuration file. Attackers can remotely exploit this to gain unauthorized access to the Druid monitoring interface. Organizations using affected RuoYi versions with Druid enabled are at risk.
💻 Affected Systems
- yangzongzhuan RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to Druid monitoring, potentially accessing sensitive database metrics, executing SQL queries, or using Druid as a foothold for further attacks.
Likely Case
Unauthorized access to Druid monitoring dashboard exposing database performance metrics, connection pools, and potentially sensitive configuration details.
If Mitigated
Limited impact if network access controls prevent external access to Druid interface or if credentials were changed from defaults.
🎯 Exploit Status
Exploit involves accessing Druid web interface with default credentials (admin/admin). Public disclosure includes specific details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.2 or later
Vendor Advisory: https://github.com/yangzongzhuan/RuoYi/issues/297
Restart Required: Yes
Instructions:
1. Upgrade RuoYi to version 4.8.2 or later. 2. Update application-druid.yml file with strong, unique credentials. 3. Restart the application server.
🔧 Temporary Workarounds
Change Druid Credentials
allManually modify the default credentials in application-druid.yml configuration file
Edit ruoyi-admin/src/main/resources/application-druid.yml
Change spring.datasource.druid.stat-view-servlet.login-username and login-password values
Restrict Network Access
linuxBlock external access to Druid monitoring interface using firewall rules
iptables -A INPUT -p tcp --dport [Druid-port] -s [trusted-ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [Druid-port] -j DROP
🧯 If You Can't Patch
- Immediately change default Druid credentials to strong, unique values
- Implement network segmentation to restrict access to Druid interface only from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check if application-druid.yml contains default credentials (admin/admin) and RuoYi version is ≤4.8.1Check Version:
Check pom.xml or release notes for RuoYi versionVerify Fix Applied:
Attempt to access Druid interface with old credentials (should fail) and verify version is ≥4.8.2📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts to Druid interface
- Successful logins from unexpected IPs to /druid/* paths
Network Indicators:
- HTTP requests to /druid/login.html from external IPs
- Traffic patterns suggesting credential guessing
SIEM Query:
source="*access.log*" AND (uri_path="/druid/*" OR user_agent="*Druid*")