Authenticated User Social Login Deletion in RuoYi-Vue-Plus

Executive Summary

RuoYi-Vue-Plus through 6.0.0 has an insecure direct object reference vulnerability. Authenticated users can delete other users' social login bindings by providing their socialId. Attackers exploit this by sending DELETE /auth/unlock/{socialId} requests with a victim's binding ID to remove GitHub, WeChat, or Gitee bindings and stored OAuth tokens, preventing social login access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /auth/unlock/{socialId} endpoints. Check logs for unusual deletion of social login bindings. Use tools like Wireshark or tcpdump to capture traffic to these endpoints.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to disrupt user access to accounts by removing social login bindings. Victims may lose access to their accounts if they rely solely on social login methods. Additionally, stored OAuth tokens could be compromised, leading to potential unauthorized access to linked services.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update RuoYi-Vue-Plus to the latest version beyond 6.0.0. Implement access controls to restrict DELETE requests to authorized users only. Review logs for past exploitation attempts and revoke any unauthorized social login bindings.

Useful 0 Not Useful 0