Executive Summary

CVE-2025-10384 is a broken function level authorization vulnerability in the yangzongzhuan RuoYi framework (up to version 4.8.1). It affects the batch role cancellation endpoint `/system/role/authUser/cancelAll`. An authenticated attacker who captures a valid session cookie can send a crafted request manipulating the `roleId` and `userIds` parameters to revoke roles from arbitrary users without proper permission, bypassing access controls. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to revoke roles from arbitrary users without authorization, potentially removing critical permissions such as administrator roles. This can lead to unauthorized privilege changes, impacting the integrity and availability of the system. Since the exploit can be performed remotely and easily, it poses a significant security risk. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /system/role/authUser/cancelAll that include manipulation of the roleId and userIds parameters. Detection involves capturing and analyzing HTTP traffic for unauthorized or unusual role cancellation attempts, especially from authenticated sessions. Commands to detect such activity could include using network traffic analysis tools like tcpdump or Wireshark to filter HTTP POST requests to the vulnerable endpoint, for example: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/system/role/authUser/cancelAll'. Additionally, web server logs can be searched for POST requests to this path with roleId and userIds parameters to identify potential exploitation attempts. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /system/role/authUser/cancelAll endpoint to trusted users only, implementing strict access controls and monitoring for unauthorized requests. Since no vendor patch or fix is currently available and the vendor did not respond, it is recommended to consider replacing the affected component or product. Additionally, monitoring and alerting on suspicious activity targeting this endpoint should be established to detect exploitation attempts early. [2]

Useful 0 Not Useful 0