| 제목 | yangzongzhuan RuoYi 4.8.3 Cross-Site Request Forgery / CWE-352 |
|---|
| 설명 | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by cross-site request forgery on state-changing GET delete endpoints.
CsrfValidateFilter only validates POST. GET /system/dept/remove/{deptId} and GET /system/menu/remove/{menuId} still perform privileged deletes. Enabling csrf.enabled=true does not block a cross-site top-level GET that reuses a logged-in administrator session.
A local test with CSRF enabled returned {"msg":"操作成功","code":0} for GET without X-CSRF-Token, and sys_dept.del_flag changed from 0 to 2. The same session sending POST without a token was rejected by the CSRF filter. An unauthenticated GET redirected to /login and did not change the row.
The attacker does not need a RuoYi account. The victim must be logged in with delete permission and must open an attacker-controlled page or link. This is distinct from RuoYi issue #321, which covers CSRF being disabled by default on POST.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| 원천 | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| 사용자 | bobtao666 (UID 100998) |
|---|
| 제출 | 2026. 09. 05. PM 07:55 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. AM 11:27 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416577 [yangzongzhuan RuoYi 4.8.3 교차 사이트 요청 위조] |
|---|
| 포인트들 | 20 |
|---|