Summary
A high-severity improper authentication vulnerability affects the SMS code verification flow in ruoyi-vue-pro's AuthController.java. An attacker who can remotely submit manipulated mobile and code values may be able to bypass intended verification checks and access protected functionality.
A high-severity improper authentication vulnerability affects the SMS code verification flow in ruoyi-vue-pro's AuthController.java. An attacker who can remotely submit manipulated mobile and code values may be able to bypass intended verification checks and access protected functionality.
Affected context
The issue occurs in deployments of YunaiV/zhijiantianya ruoyi-vue-pro that expose the SMS code verification functionality and rely on AuthController.java to validate the mobile and code arguments. Risk is higher when these inputs are insufficiently bound to a server-issued verification challenge, user identity, expiration period, or one-time-use requirement.
The issue occurs in deployments of YunaiV/zhijiantianya ruoyi-vue-pro that expose the SMS code verification functionality and rely on AuthController.java to validate the mobile and code arguments. Risk is higher when these inputs are insufficiently bound to a server-issued verification challenge, user identity, expiration period, or one-time-use requirement.
Exploit preconditions
- Attack surface: Remotely accessible SMS code verification endpoint
- Required access: Ability to send requests to the authentication interface; valid credentials may not be required
- Trigger point: Processing of the
mobileandcodearguments byAuthController.java - Why exploitation is possible: Authentication decisions may accept attacker-controlled or inadequately validated verification values
- Disclosure context: The exploit is publicly reported, which may increase exposure and scanning activity
- Attack surface: Remotely accessible SMS code verification endpoint
- Required access: Ability to send requests to the authentication interface; valid credentials may not be required
- Trigger point: Processing of the
mobileandcodearguments byAuthController.java - Why exploitation is possible: Authentication decisions may accept attacker-controlled or inadequately validated verification values
- Disclosure context: The exploit is publicly reported, which may increase exposure and scanning activity
Why this happens
The vulnerability is consistent with CWE-287: Improper Authentication, where an application fails to reliably verify that a requester satisfies the required authentication conditions. In this case, the SMS verification flow appears to make an unsafe trust decision involving the supplied mobile number and verification code, potentially without sufficiently binding the code to the intended transaction, enforcing its lifecycle, or rejecting invalid states.
The vulnerability is consistent with CWE-287: Improper Authentication, where an application fails to reliably verify that a requester satisfies the required authentication conditions. In this case, the SMS verification flow appears to make an unsafe trust decision involving the supplied mobile number and verification code, potentially without sufficiently binding the code to the intended transaction, enforcing its lifecycle, or rejecting invalid states.
Potential impact
- An attacker may bypass SMS-based authentication checks
- Unauthorized users could gain access to protected application functions
- User accounts or sessions may be exposed, depending on the affected authentication flow
- Attackers could perform actions with privileges associated with an improperly authenticated identity
- Authentication logs and downstream security controls could be undermined
- An attacker may bypass SMS-based authentication checks
- Unauthorized users could gain access to protected application functions
- User accounts or sessions may be exposed, depending on the affected authentication flow
- Attackers could perform actions with privileges associated with an improperly authenticated identity
- Authentication logs and downstream security controls could be undermined
General mitigation guidance
Mitigation generally focuses on making authentication decisions server-controlled and context-bound.
Common defensive patterns include:
- Bind each verification code to the intended mobile number, authentication transaction, purpose, and short validity period
- Enforce one-time use, expiration, retry limits, and server-side invalidation after successful verification
- Validate both mobile and code values using strict server-side rules rather than trusting client-provided state
- Ensure authentication success is issued only after all required verification conditions are satisfied
- Apply rate limiting, abuse detection, and account-protection controls to verification endpoints
- Use least privilege for identities created or restored through the SMS flow
- Avoid exposing detailed responses that reveal whether a mobile number or code is valid
Mitigation generally focuses on making authentication decisions server-controlled and context-bound.
Common defensive patterns include:
- Bind each verification code to the intended mobile number, authentication transaction, purpose, and short validity period
- Enforce one-time use, expiration, retry limits, and server-side invalidation after successful verification
- Validate both mobile and code values using strict server-side rules rather than trusting client-provided state
- Ensure authentication success is issued only after all required verification conditions are satisfied
- Apply rate limiting, abuse detection, and account-protection controls to verification endpoints
- Use least privilege for identities created or restored through the SMS flow
- Avoid exposing detailed responses that reveal whether a mobile number or code is valid
How teams detect issues like this
Detection approaches may include:
- Static analysis and code review of authentication branches that trust request parameters directly
- Searching for SMS verification logic that lacks transaction binding, expiration, one-time-use enforcement, or retry controls
- Testing whether mobile and code values can be substituted, replayed, omitted, or used across authentication contexts
- Monitoring repeated verification failures, unusual request rates, code reuse, and authentication successes without corresponding SMS delivery events
- Enforcing API policies for rate limits, consistent error responses, and audit logging at authentication boundaries
- Using automated security review tools to identify weak authentication checks and untrusted authorization decisions
Detection approaches may include:
- Static analysis and code review of authentication branches that trust request parameters directly
- Searching for SMS verification logic that lacks transaction binding, expiration, one-time-use enforcement, or retry controls
- Testing whether mobile and code values can be substituted, replayed, omitted, or used across authentication contexts
- Monitoring repeated verification failures, unusual request rates, code reuse, and authentication successes without corresponding SMS delivery events
- Enforcing API policies for rate limits, consistent error responses, and audit logging at authentication boundaries
- Using automated security review tools to identify weak authentication checks and untrusted authorization decisions
Sources
| Source | Link |
|---|---|
| gist. | gist.github.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
