Ruoyi Vue Plus
Monthly
Broken function-level authorization in RuoYi-Vue-Plus through 5.6.2 allows any authenticated low-privileged user to manipulate workflow approval tasks - including reassigning pending approvals to arbitrary users, urging tasks, and enumerating all pending and completed tasks - by exploiting the absence of permission annotations on FlwTaskController endpoints under /workflow/task. This directly defeats segregation of duties in organizational approval chains, enabling a standard user to redirect approvals meant for specific roles and potentially approve transactions or actions they should never have authority over. A publicly available exploit is referenced in the project's GitHub issue tracker; no CISA KEV listing has been confirmed at time of analysis, suggesting targeted rather than widespread exploitation.
Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV.
RuoYi-Vue-Plus (through 5.5.1) allows arbitrary file read/write through QLExpress expression evaluation in the snailjob workflow node checker. Attackers can use the File class to access any file on the server. PoC available.
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Broken function-level authorization in RuoYi-Vue-Plus through 5.6.2 allows any authenticated low-privileged user to manipulate workflow approval tasks - including reassigning pending approvals to arbitrary users, urging tasks, and enumerating all pending and completed tasks - by exploiting the absence of permission annotations on FlwTaskController endpoints under /workflow/task. This directly defeats segregation of duties in organizational approval chains, enabling a standard user to redirect approvals meant for specific roles and potentially approve transactions or actions they should never have authority over. A publicly available exploit is referenced in the project's GitHub issue tracker; no CISA KEV listing has been confirmed at time of analysis, suggesting targeted rather than widespread exploitation.
Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV.
RuoYi-Vue-Plus (through 5.5.1) allows arbitrary file read/write through QLExpress expression evaluation in the snailjob workflow node checker. Attackers can use the File class to access any file on the server. PoC available.
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.