External risk intelligence

RuoYi SQL Injection via createTable Function in SqlUtil.java

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2024-57521

RuoYi is a widely used Java-based web application framework. Web applications built on this framework are commonly deployed as public-facing enterprise management or administrative platforms, making the underlying application components and their features, such as database utility functions, reachable from the internet in standard deployments.

SQL Injection

Ruoyi

4.7.9 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the RuoYi framework, a widely used Java-based web application platform. This flaw, specifically a SQL injection, could allow attackers to execute unauthorized code within affected systems. The primary concern is to confirm if any business-critical applications are running on this framework version and to understand the potential exposure.

A coding flaw allows remote code execution.
Confirm if business systems use affected software.
Understand potential impact on business operations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the `createTable` function. This function, located in `SqlUtil.java`, is susceptible to SQL injection due to insufficient validation. If successful, an attacker could potentially execute arbitrary code on the affected system.

Unauthenticated network access required.
Triggered via the `createTable` function.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code by exploiting a SQL injection flaw in a database utility function, potentially impacting system data and service behavior.

System data and service integrity at risk.
Via network to a vulnerable function.
Arbitrary code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this critical SQL injection vulnerability in RuoYi. The first practical step is to identify all instances of the affected technology, determine their exposure and criticality, and confirm ownership before planning remediation.

Own the issue: Application owners, Platform teams.
Verify first: Confirm affected assets and exposure.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is RuoYi and how is it used?

RuoYi is a popular Java-based open-source framework used by organizations to rapidly build enterprise management and administrative web applications. Developers rely on it to handle common business functions, including database interactions, providing a foundation for internal tools or public-facing operational platforms.

What does CVE-2024-57521 mean by SQL injection?

This CVE refers to a weakness classified as CWE-89, where an application fails to properly sanitize user input before incorporating it into database queries. In this specific case, the flaw exists in the createTable function. Instead of just querying data, an attacker can manipulate these inputs to inject and execute their own unauthorized code on the server.

How is the createTable vulnerability triggered?

An attacker triggers this vulnerability by sending a specially crafted request that reaches the vulnerable createTable function within SqlUtil.java. The process requires unauthenticated network access to the target system. It is important to note that the flaw is specific to the handling of inputs in this utility function and is not triggered by standard, legitimate database operations.

Is my RuoYi deployment at risk?

RuoYi applications are often deployed as public-facing enterprise platforms, and according to Halo Surface Signal, this makes the affected components, including database utility functions, reachable from the internet. You should care if your organization runs RuoYi versions 4.7.9 or earlier, as these are inherently more accessible to remote, unauthenticated actors.

What should I do if I am running RuoYi?

Your first step is to perform an inventory to confirm if any of your business-critical applications are using RuoYi version 4.7.9 or earlier. Once identified, evaluate the network exposure of these instances and assign ownership to the appropriate platform teams. Use this information to prioritize and plan your remediation efforts to secure the affected systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.