| タイトル | y_project RuoYi 4.8.3 Cross Site Scripting |
|---|
| 説明 | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xssRuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| ソース | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| ユーザー | bobtao666 (UID 100998) |
|---|
| 送信 | 2026年09月06日 17:59 (2 月 ago) |
|---|
| モデレーション | 2026年10月11日 11:36 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416579 [y_project RuoYi 迄 4.8.3 Dictionary Data Drawer Preview /system/dict/data/add renderDrawer cssClass クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|