How CVE-2025-28413 Works
The vulnerability in RuoYi v4.8.0 stems from improper access control in the `SysDictTypeController` component. Attackers exploit weak input validation in the metrics endpoint to inject malicious payloads, leading to privilege escalation. By crafting a specially crafted HTTP request, an attacker bypasses authentication checks and gains administrative rights. The flaw occurs due to insufficient sanitization of user-supplied data before processing, allowing unauthorized access to sensitive functions.
DailyCVE Form
Platform: RuoYi
Version: 4.8.0
Vulnerability: Privilege Escalation
Severity: Critical
Date: 04/09/2025
What Undercode Say:
Exploitation
1. Craft a malicious POST request to `/system/dict/metrics`:
POST /system/dict/metrics HTTP/1.1
Host: target.com
Content-Type: application/json
Payload: {"query":"malicious_script"}
2. Use curl for exploitation:
curl -X POST -d '{"query":"attacker_payload"}' http://target.com/system/dict/metrics
Protection
1. Patch RuoYi to the latest version.
2. Implement strict input validation:
@PostMapping("/metrics")
public ResponseEntity<?> validateInput(@RequestBody String input) {
if (!input.matches("[a-zA-Z0-9]+")) {
throw new IllegalArgumentException("Invalid input");
}
}
3. Restrict endpoint access via Spring Security:
http.authorizeRequests()
.antMatchers("/system/dict/").hasRole("ADMIN")
.anyRequest().authenticated();
4. Log suspicious activity:
grep -i "malicious_script" /var/log/ruoyi/access.log
5. Apply WAF rules to block exploit attempts:
location /system/dict/metrics {
if ($args ~ "query=.[;|&]") {
return 403;
}
}
6. Verify patch effectiveness:
npm audit --production
7. Monitor system privileges:
SELECT FROM sys_user WHERE role = 'admin';
8. Disable unused endpoints:
ruoyi.security.disable-metrics=true
9. Use CSRF protection:
<input type="hidden" name="_csrf" value="${_csrf.token}"/>
10. Conduct penetration testing:
nmap -p 8080 --script http-vuln-cve2025-28413 target.com
References:
Reported By: https://nvd.nist.gov/vuln/detail/CVE-2025-28413
Extra Source Hub:
Undercode
