| 제목 | dromara RuoYi-Vue-Plus from 0 to 5.6.2 Incorrect Authorization |
|---|
| 설명 | The application implements coarse-grained authorization via `@SaCheckPermission` annotations on controller endpoints, which verify that the authenticated user holds the required role or menu permission (e.g., workflow:instance:query). However, no fine-grained data-ownership verification is performed at the service layer. This allows a user with a given role permission to access or modify resources belonging to other users by manipulating resource identifiers (e.g., `businessId`, `instanceId`, `definitionId`) supplied in the request path or body.
Root Cause
The authorization model conflates function-level access (whether a user may enter a feature) with data-level access (whether a user may operate on a specific record). The @SaCheckPermission annotation answers only the first question. Service-layer methods accept resource identifiers as parameters without verifying that the current user—obtainable via LoginHelper.getUserId() or LoginHelper.getUserIdStr()—is the owner (typically matched against the record's createBy column) or an assigned participant of the target resource.
Impact
A malicious authenticated user who possesses a given functional permission can perform the corresponding operation on any record within the system, regardless of ownership. This constitutes horizontal privilege escalation: reading, modifying, or deleting data belonging to peer users within the same tenant.
|
|---|
| 원천 | ⚠️ https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1 |
|---|
| 사용자 | Jarv1s123 (UID 99572) |
|---|
| 제출 | 2026. 07. 06. PM 01:10 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 21. PM 03:14 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394113 [Dromara RuoYi-Vue-Plus 까지 5.6.2 Workflow Endpoint 권한 상승] |
|---|
| 포인트들 | 20 |
|---|