| عنوان | yangzongzhuan RuoYi 4.8.3 Cross-Site Request Forgery / CWE-352 |
|---|
| الوصف | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by cross-site request forgery on state-changing GET delete endpoints.
CsrfValidateFilter only validates POST. GET /system/dept/remove/{deptId} and GET /system/menu/remove/{menuId} still perform privileged deletes. Enabling csrf.enabled=true does not block a cross-site top-level GET that reuses a logged-in administrator session.
A local test with CSRF enabled returned {"msg":"操作成功","code":0} for GET without X-CSRF-Token, and sys_dept.del_flag changed from 0 to 2. The same session sending POST without a token was rejected by the CSRF filter. An unauthenticated GET redirected to /login and did not change the row.
The attacker does not need a RuoYi account. The victim must be logged in with delete permission and must open an attacker-controlled page or link. This is distinct from RuoYi issue #321, which covers CSRF being disabled by default on POST.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| المصدر | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| المستخدم | bobtao666 (UID 100998) |
|---|
| ارسال | 05/09/2026 07:55 PM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 11:27 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416577 [yangzongzhuan RuoYi 4.8.3 تزوير طلبات عبر المواقع] |
|---|
| النقاط | 20 |
|---|