| タイトル | yangzongzhuan RuoYi 4.8.3 Privilege Escalation |
|---|
| 説明 | RuoYi 4.8.3 (commit 7995a83e04e1a88aaea5a8a7c50570dffcb145e0) has a privilege-escalation issue in role-key handling. POST /system/role/authDataScope lets an authenticated user with system:role:edit persist roleKey=common,admin on ordinary role ID 2. checkRoleAllowed only rejects roleId==1. Uniqueness compares the full string, so existing key admin does not block common,admin.
On the next login, selectRoleKeys splits roleKey on commas and UserRealm hands the tokens to Shiro. The caller then has the admin Shiro role without being bound to role ID 1 and without receiving *:*:* wildcard permissions.
A local Docker test with the bundled ry/admin123 account was denied on POST /tool/gen/createTable before the mutation (HTTP 200 HTML title RuoYi - 403). After the mutation and a fresh login, the same CREATE TABLE request returned {"msg":"操作成功","code":0}, created table cve_rolekey_poc_7995, and wrote gen_table metadata create_by=ry.
This is distinct from CVE-2024-57438 (user-role ID assignment), CVE-2025-56396 (department data scope), CVE-2026-37669 / issue 328 (deptIds/userIds mapping), issue 300 (createTable SQL filter bypass), and issue 205 (generator RCE). Proven impact is unauthorized CREATE TABLE plus generator metadata write, not arbitrary SQL or RCE.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md |
|---|
| ソース | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md |
|---|
| ユーザー | bobtao666 (UID 100998) |
|---|
| 送信 | 2026年09月08日 20:29 (2 月 ago) |
|---|
| モデレーション | 2026年10月11日 12:57 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416601 [yangzongzhuan RuoYi 迄 4.8.3 authDataScope checkRoleAllowed roleKey 特権昇格] |
|---|
| ポイント | 20 |
|---|