| 제목 | y_project RuoYi 4.8.3 Cross Site Scripting |
|---|
| 설명 | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xssRuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| 원천 | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| 사용자 | bobtao666 (UID 100998) |
|---|
| 제출 | 2026. 09. 06. PM 05:59 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. AM 11:36 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416579 [y_project RuoYi 까지 4.8.3 Dictionary Data Drawer Preview /system/dict/data/add renderDrawer cssClass 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|