Skip to content

Latest commit

 

History

History
43 lines (22 loc) · 1.53 KB

ruoyi_elevation_of_privileges.md

File metadata and controls

43 lines (22 loc) · 1.53 KB

Elevation of privilege vulnerability in the ruoyi project

The ruoyi project is a 6.6k star GitHub project also open-sourced on gitee, which has an elevation of privilege vulnerability. Users with system monitoring privileges can see the session id of admin, and this system recognizes users by their session ids, so users with system monitoring privileges can impersonate the session id of admin to achieve elevated privileges.

Version & Reference

ruoyi project 4.8.0

https://gitee.com/y_project/RuoYi

https://github.com/yangzongzhuan/RuoYi

https://ruoyi.vip/

Vulnerability causes

1735209701386

The session id of the admin can be seen in the system monitor, and the session id is used as an identifier to recognize the identity when the message is sent, so identity impersonation can be realized.

1735209753565

1735209863312

You can see that the session id is exactly the same, 3e.... .bb is what is in the cookie. Therefore identity impersonation can be realized.

Vulnerability reproduce & Impact

Further privilege elevation can be done using the session id of admin.

1735210019153

At first we didn't have full access.

1735210041427

Use the admin identity to assign permissions.

1735210073030

At this point we have full access.

The vulnerability is exploited by a user with system monitoring privileges, admin user online. The impact is an elevation of privilege.