Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in the RuoYi-Vue-Plus component, which could allow unauthorized access to execute code and manipulate files on affected systems. The issue stems from a failure to properly validate user input within a specific interface, potentially enabling malicious actors to read or write files. At a high level, this could expose sensitive data or disrupt operations if the affected component is in use.
- Code execution and file manipulation risk.
- Confirms exposure in web-facing API services.
- Assess relevance and potential system impact.
Attack Path
How an attacker could exploit the issue
An attacker can reach an interface in the snailjob component that processes QLExpress expressions. Because this component doesn't properly check user-provided input, an attacker can exploit this by using the File class to read or write files on the system.
- No authentication required for access.
- Triggered by sending a malicious QLExpress expression.
- Allows arbitrary file read/write.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, this vulnerability could allow an unauthenticated attacker to read or write arbitrary files on the system by sending a specially crafted request to the `/snail-job/workflow/check-node-expression` interface. This could lead to the exposure or modification of system and user data.
- System files could be accessed.
- Unfiltered input allows arbitrary file operations.
- Unauthorized data access or modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
The snailjob component within RuoYi-Vue-Plus, specifically the `/snail-job/workflow/check-node-expression` interface, is susceptible to arbitrary file read/write due to insufficient input filtering for QLExpress expressions. Application owners and platform teams are likely responsible for managing this component. The initial practical step involves identifying all instances of RuoYi-Vue-Plus, assessing their exposure and criticality, and then coordinating remediation efforts based on these findings.
- Application or platform teams own the issue.
- Verify affected systems and their exposure.
- Plan remediation based on risk assessment.
