| タイトル | dromara RuoYi-Vue-Plus from 0 to 5.6.2 Incorrect Authorization |
|---|
| 説明 | The application implements coarse-grained authorization via `@SaCheckPermission` annotations on controller endpoints, which verify that the authenticated user holds the required role or menu permission (e.g., workflow:instance:query). However, no fine-grained data-ownership verification is performed at the service layer. This allows a user with a given role permission to access or modify resources belonging to other users by manipulating resource identifiers (e.g., `businessId`, `instanceId`, `definitionId`) supplied in the request path or body.
Root Cause
The authorization model conflates function-level access (whether a user may enter a feature) with data-level access (whether a user may operate on a specific record). The @SaCheckPermission annotation answers only the first question. Service-layer methods accept resource identifiers as parameters without verifying that the current user—obtainable via LoginHelper.getUserId() or LoginHelper.getUserIdStr()—is the owner (typically matched against the record's createBy column) or an assigned participant of the target resource.
Impact
A malicious authenticated user who possesses a given functional permission can perform the corresponding operation on any record within the system, regardless of ownership. This constitutes horizontal privilege escalation: reading, modifying, or deleting data belonging to peer users within the same tenant.
|
|---|
| ソース | ⚠️ https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1 |
|---|
| ユーザー | Jarv1s123 (UID 99572) |
|---|
| 送信 | 2026年07月06日 13:10 (2 月 ago) |
|---|
| モデレーション | 2026年08月21日 15:14 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 394113 [Dromara RuoYi-Vue-Plus 迄 5.6.2 Workflow Endpoint 特権昇格] |
|---|
| ポイント | 20 |
|---|