CVE-2024-57436

HighPublic PoC

Published: 29 January 2025

Published

29 January 2025

Modified

14 May 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0024 47.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57436 is a high-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Ruoyi Ruoyi. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2024-57436 affects RuoYi version 4.8.0, a vulnerability classified under CWE-922 that exposes the admin session ID through the system monitoring interface. Unauthorized attackers can view this sensitive information, enabling them to craft a cookie for impersonating Admin users. The issue received a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low complexity but requiring high privileges.

Attackers with high privileges can exploit this over the network without user interaction to achieve high impacts on confidentiality, integrity, and availability. By accessing the system monitoring feature, they obtain the admin session ID and construct a malicious cookie, allowing full impersonation of Admin accounts and potential takeover of administrative functions.

Advisories referenced in the CVE include detailed write-ups on GitHub at https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md, the official RuoYi repository at https://github.com/yangzongzhuan/RuoYi, and the project site at https://ruoyi.vip/. No specific patch or mitigation steps are detailed in the provided CVE information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-0194

Vulnerability details

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

CWE(s): CWE-922

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

T1606.001 Web Cookies Credential Access

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

attack.mitre.org →

Why these techniques?

Vulnerability exposes admin session ID in system monitoring, allowing unauthorized attackers to steal web session cookies (T1539), forge web credentials with crafted cookies (T1606.001), and use stolen web session cookies as alternate authentication material (T1550.004) for admin impersonation.