CVE-2024-57436

HighPublic PoC

Published: 29 January 2025

Published

29 January 2025

Modified

14 May 2025

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0024 46.9th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57436 is a high-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Ruoyi Ruoyi. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 46.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Steal Web Session Cookie (T1539) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to prevent high-privilege users from accessing admin session IDs via the system monitoring interface.

AC-6 Least Privilege good match

prevent

Applies least privilege to restrict high-privilege users from viewing sensitive admin session information in monitoring features.

SC-23 Session Authenticity good match

prevent

Protects session authenticity to mitigate impersonation attacks using crafted cookies derived from leaked session IDs.

MITRE ATT&CK Enterprise TechniquesAI

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

T1606.001 Web Cookies Credential Access

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

attack.mitre.org →

Why these techniques?

Vulnerability exposes admin session ID in system monitoring, allowing unauthorized attackers to steal web session cookies (T1539), forge web credentials with crafted cookies (T1606.001), and use stolen web session cookies as alternate authentication material (T1550.004) for admin impersonation.

NVD Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Deeper analysisAI

CVE-2024-57436 affects RuoYi version 4.8.0, a vulnerability classified under CWE-922 that exposes the admin session ID through the system monitoring interface. Unauthorized attackers can view this sensitive information, enabling them to craft a cookie for impersonating Admin users. The issue received a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low complexity but requiring high privileges.

Attackers with high privileges can exploit this over the network without user interaction to achieve high impacts on confidentiality, integrity, and availability. By accessing the system monitoring feature, they obtain the admin session ID and construct a malicious cookie, allowing full impersonation of Admin accounts and potential takeover of administrative functions.

Advisories referenced in the CVE include detailed write-ups on GitHub at https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md, the official RuoYi repository at https://github.com/yangzongzhuan/RuoYi, and the project site at https://ruoyi.vip/. No specific patch or mitigation steps are detailed in the provided CVE information.